DPDPA

The Delaware Personal Data Privacy Act (DPDPA) is Delaware's comprehensive consumer privacy law. It has been in effect since 1 January 2025. Like the other state laws built on the same model, it gives Delaware residents rights over their personal data and puts duties on the businesses that decide how that data is used (controllers) and on the vendors that handle it for them (processors).

Virginia-style law with low thresholds and coverage of many nonprofits.

• Businesses that process personal data of the state's residents above the law's thresholds. Thresholds, exemptions and sensitive-data rules differ by state.
• The thresholds usually turn on how many Delaware residents' personal data a business handles in a year, and whether it earns revenue from selling personal data. Check the statute for the exact figures.
• Like most state privacy laws, it exempts some organizations and data, commonly including data already covered by HIPAA or the Gramm-Leach-Bliley Act, and data about people acting in an employment or commercial capacity.

Delaware residents can generally ask a business to confirm and access their personal data, correct it, delete it and get a copy in a portable format, and can opt out of targeted advertising, the sale of their data, and profiling that produces legal or similarly significant effects. Businesses generally have 45 days to respond, extendable once. Residents can usually appeal a refusal.

Enforced by the Delaware Attorney General. Violations carry civil penalties set by the statute.

1. Check the thresholds against your Delaware consumer numbers and any data sales.
2. Map the personal and sensitive data you hold about Delaware residents.
3. Update your privacy notice and add the opt-out routes the law requires.
4. Set up requests and appeals within the response deadlines.
5. Put DPDPA-ready terms in processor contracts.
6. Build one program for all state laws, then add Delaware's departures.