With the growing momentum of data privacy legislation across the United States, Delaware has introduced its own comprehensive privacy law — the Delaware Personal Data Privacy Act (DPDPA). Signed into law on September 11, 2023, the DPDPA will take effect on January 1, 2025, imposing new obligations on businesses handling consumer data and aligning Delaware with other states like California Consumer Privacy Act/California Privacy Rights Act (CCPA/CPRA), Virginia Consumer Data Protection Act (VCDPA), and Colorado Privacy Act (CPA).

If your business operates in Delaware or processes the personal data of Delaware residents, it’s essential to understand the DPDPA’s requirements to remain compliant and avoid penalties.

Who Does the DPDPA Apply To?

The Delaware Personal Data Privacy Act applies to data controllers that meet the following criteria:

• Process personal data of at least 35,000 Delaware residents annually.
• Process personal data of at least 10,000 Delaware residents and derive more than 20% of gross revenue from the sale of personal data.

Note: The law does not apply to nonprofits, higher education institutions, or entities already covered by federal privacy laws such as:

• Health Insurance Portability and Accountability Act (HIPAA)
• Gramm – Leach – Bliley Act (GLBA)
• Fair Credit Reporting Act (FCRA)

Key Definitions Under DPDPA

To comply with the DPDPA effectively, businesses must understand these critical terms:

• Personal Data: Any information that identifies or can be linked to an individual.
• Sensitive Data: Includes information such as race, ethnicity, health data, sexual orientation, biometric data, and data collected from children.
• Controller: A business that determines how and why personal data is processed.
• Processor: An entity that processes personal data on behalf of the controller.

DPDPA Compliance Requirements for Businesses

To ensure compliance with Delaware’s new privacy law, businesses must meet the following obligations:

1. Transparency Through Privacy Notices

Businesses must provide clear and accessible privacy notices that outline:

• Categories of personal data collected.
• Purpose for data processing.
• Consumer rights and how to exercise them.
• Disclosure of any data – sharing practices with third parties.

2. Consumer Rights Under DPDPA

The DPDPA empowers Delaware residents with five key rights:

• Right to Access: Consumers can request access to their personal data.
• Right to Correct: Individuals may correct inaccuracies in their personal information.
• Right to Delete: Consumers can request that businesses delete their personal data.
• Right to Opt – Out: Consumers can opt out of targeted advertising, data sales, and profiling.
• Right to Data Portability: Businesses must provide personal data in a machine – readable format when requested.

3. Consent for Processing Sensitive Data

Businesses must obtain explicit consent before processing sensitive data. Consent must be freely given, specific, informed, and unambiguous.

4. Data Protection Impact Assessments (DPIAs)

For data processing that presents a heightened risk to consumer privacy, businesses must conduct Data Protection Impact Assessments (DPIAs). This includes processing for targeted advertising, profiling, and the sale of personal data.

5. Processor Contracts and Vendor Management

Controllers must establish Data Processing Agreements (DPAs) with processors to ensure compliance with the DPDPA and to protect consumer data.

Penalties for Non – Compliance

The Delaware Department of Justice (DOJ) is responsible for enforcing the DPDPA. Starting January 1, 2025, non – compliant businesses may face:

• Civil penalties of up to $10,000 per violation.
• Injunctive relief to cease unlawful practices.

Delaware provides a 60 – day cure period for businesses to address any identified violations. However, as with other state laws, this cure period may be eliminated after January 1, 2026, leaving businesses vulnerable to immediate enforcement actions.

How Curated Privacy LLC Can Help Your Business Achieve DPDPA Compliance

Staying compliant with the DPDPA requires a proactive approach to data privacy management. At Curated Privacy LLC, we specialize in guiding businesses through complex privacy laws with tailored solutions that include:

• Privacy Policy Drafting and Updates: Develop transparent privacy notices aligned with DPDPA requirements.
• Data Protection Impact Assessments (DPIAs): Identify and mitigate privacy risks in high – risk data processing activities.
• Consumer Rights Management: Implement systems to process data access, correction, and deletion requests efficiently.
• Vendor Risk Management: Ensure processors and third parties adhere to DPDPA compliance through comprehensive contracts.

Schedule a FREE Consultation Today!
🌐 www.curatedprivacy.com | 📧 info@curatedprivacy.com

Why DPDPA Compliance Matters for Your Business

With the DPDPA set to take effect in January 2025, businesses must take proactive steps to implement compliant privacy practices. Non – compliance not only exposes companies to financial penalties but also damages consumer trust and brand reputation.

Partnering with Curated Privacy LLC ensures that your business meets regulatory obligations, mitigates risks, and stays ahead of evolving data privacy requirements.