Delaware enacts HB 380: Key updates to the Delaware Personal Data Privacy Act

On 2 Sept., Gov. Matt Meyer, D-Del., signed Delaware House Bill 380 into law, which was originally introduced by state Rep. Krista Griffith, D-Del., to amend the Delaware Personal Data Privacy Act. The new law makes several material changes, some of which cross-functional privacy teams must operationalize by the 1 Jan. 2027 effective date. 

HB 380 significantly expands the DPDPA's reach by lowering the statutory thresholds to businesses that control or process the personal data of 10,000 or more consumers, or 5,000 consumers if at least 20% of their gross revenue comes from selling personal data. This downward adjustment from 35,000 and 10,000, respectively, brings a broader set of small and midsize businesses within the scope of the DPDPA. 

Many companies will need to evaluate whether they fall within the law's reach and whether their existing data governance practices meet the statute's controller, processor and third-party obligations.

The law also applies new data minimization requirements to companies that obtain consent to process sensitive data. Controllers may process sensitive data only when it is reasonably necessary and proportionate to the purpose disclosed to the consumer at the time of collection. Importantly, controllers may not sell sensitive data to third parties unless it is strictly necessary to provide or maintain the product or service requested by the consumer. This approach aligns Delaware's law with other states like Colorado, Connecticut and Virginia that require affirmative consent to process sensitive data, but Delaware goes further by introducing a "strictly necessary" standard for sensitive data processing.