On September 2, 2026, Delaware Governor Matt Meyer signed House Bill 380 (“HB 380”), significantly expanding the scope of the Delaware Personal Data Privacy Act (“DPDPA”) effective January 1, 2027.

Among other changes, HB 380 lowers the DPDPA’s applicability threshold from 35,000 to 10,000 Delaware consumers. For businesses that derive more than 20% of their gross revenue from the sale of personal data, HB 380 lowers the applicability threshold from 10,000 to 5,000 consumers. The DPDPA as amended now will also apply to third parties that acquire personal data from controllers.

The amendments also expand consumer protections relating to sensitive data and profiling. In particular, HB 380:

• expands the definition of sensitive data to include, among other categories, national origin, certain health information, neural data, financial account credentials and government-issued identification numbers;
• expands the right to opt out of profiling used to make automated decisions;
• expands the access right to include certain inferences derived from personal data; and
• adds new contracting, due diligence and assessment requirements for certain data collection and processing activities, including the sale of personal data and the use of personal data for targeted advertising purposes.

Notably, the amendments broaden the profiling opt-out right by applying it to profiling in furtherance of “automated” decisions that produce legal or similarly significant effects, rather than only “solely automated” decisions.

Among the changes in controllers’ obligations, controllers are required to enter into contracts with third parties to whom personal data is disclosed, conduct due diligence on those third parties, and fulfill certain criteria before selling sensitive data.

Controllers that disclose reports to third parties for use in making decisions that produce legal or similarly significant effects must contractually require those third parties to provide adverse-action notices and related disclosures. Upon request, controllers must also provide Delaware consumers with certain information within 30 days, including the personal data maintained about them, the sources of personal data used in profiling them, and the identity of third parties that received reports concerning them during the preceding 24 months.

Governor Meyer also signed House Bill 381 (“HB 381”) on September 2, 2026. HB 381 separately amends Delaware’s data breach notification law to require businesses to notify the Delaware Attorney General within 60 days of determining that a breach occurred. Unlike HB 380, HB 381 took effect upon signing.

HB 380 takes effect January 1, 2027.