Delaware's Data Privacy Law Takes Major Rewrite, Effective Jan. 1, 2027
Delaware House Bill 380 substantially revises the Delaware Personal Data Privacy Act, taking effect January 1, 2027, and requiring counsel to re-map consumer-data compliance obligations ahead of the new law.
Delaware has amended its comprehensive consumer privacy statute with House Bill 380, which takes effect January 1, 2027 and significantly expands the Delaware Personal Data Privacy Act. The source available to us is a single law-firm client alert and its summary is truncated, so the precise scope of the changes — which thresholds, duties, exemptions, cure periods or enforcement provisions were altered — is not confirmed here and should be checked against the enrolled bill text before reliance.
Why sophisticated counsel should care: DPDPA sits in a fast-moving state landscape, and a significant in-state rewrite is the kind of development that ripples beyond Delaware. Companies with national customer bases typically maintain state-by-state privacy matrices, so a Delaware change forces re-paperwork of notices, consent flows, data-processing terms, vendor contracts, and rights-request handling, and it moves internal compliance deadlines forward. It is also a reminder that state-level divergence persists despite harmonization efforts, which matters for consumer-facing businesses, adtech, and any firm advising on multi-state data strategy.
Practical next steps: pull the enacted text and a side-by-side comparison of old versus new obligations, identify Delaware-touching processing and sales of personal data, then close the gap list against the compliance program and existing vendor and marketing contracts well ahead of the January 2027 effective date. Watch for further amendment or guidance in the interim.