Delaware Personal Data Privacy Act (DPDPA)

The DPDPA was signed into law on September 11, 2023, and came into effect on January 1, 2025.

The DPDPA applies to businesses in Delaware or targeting its residents that, in the prior year, processed personal data of not less than 35,000 consumers (excluding payment data) or processed not less than 10,000 consumers while earning over 20% of their gross revenue from the sale of personal data.

The DPDPA provides consumers multiple rights, such as the right to access, correct, delete, obtain a copy, know, and opt-out of processing.

Businesses must obtain consent, ensure data minimization and purpose limitation, provide privacy notice, opt-out, security, and non-discrimination requirements, and conduct data protection assessments.

The DPDPA empowers the Department of Justice (DOJ) with the enforcement authority to investigate and prosecute violations.

Before bringing an action, if the violation can be cured, the DOJ must provide a 60-day cure period to the controller. If the violation remains uncured after this cure period, the DOJ may bring an enforcement action against the controller.

The provision related to the cure period would sunset on December 31, 2025. Beginning January 1, 2026, the Delaware Department of Justice may have the discretion to provide an opportunity to cure an alleged violation.