Delaware Governor signs HB 380, amending the DPDPA effective Jan 1 2027

What happened

Governor Meyer signed HB 380 on September 2, amending the Delaware Personal Data Privacy Act. The amendment expands the definition of sensitive data, lowers applicability thresholds, adds new contractual and due‑diligence requirements for third‑party disclosures, and modifies consumer rights. The changes become effective on January 1, 2027.

Why it matters for trust and compliance

• Its status is signed. It is enacted but may not be in force yet. Check the effective date before planning around it.
• The amendment significantly strengthens privacy protections and expands data‑controller obligations in Delaware.
• Takes effect January 1, 2027.
• It relates to FCRA. The regulations library explains what that law requires.

Who is affected

Recommended actions

1. Review consent, cookie and tracking practices against the requirement.
2. Check that privacy notices describe the practices this addresses.
3. Confirm access, correction, deletion and opt-out requests are handled within the required time.
4. Revisit retention schedules and data minimisation for the data involved.
5. Map the security requirements to existing controls and close gaps.
6. Inventory AI or automated decision systems in scope and their assessments.
7. Confirm handling of sensitive data categories meets the stricter rules.