Delaware Enacts House Bill 380, Overhauling State Privacy Law

House Bill 380, passed in Delaware’s 2026 session, widens the scope of personal data covered and strengthens consent requirements, imposes minimum standards for security safeguards, and introduces a new duty for companies to report data‑breach incidents to state regulators within 72 hours. Existing Delaware‑registered businesses—whether small firms or multinational corporate subsidiaries—must reassess their data‑processing activities to ensure that all personal information, including employee and customer data, is addressed under the new definitions. The law also creates a state‑appointed compliance office that can conduct audits and issue enforceable penalties ranging from administrative fines up to 10 % of a company’s Delaware‑wide annual revenue. Firms should begin by reviewing their data‑inventory practices, updating privacy notices, and establishing breach‑response workflows that trigger the mandatory reporting window. From the next quarter—January 2027 onward—state‑based compliance teams could face increased scrutiny, so early adjustment will mitigate audit risk and potential liability.