Delaware Privacy Amendments Add AI Profiling Duties for Employers
Signed September 2, 2026 and effective January 1, 2027, Delaware's privacy amendments lower coverage thresholds, add a "resident" category for vendor-sourced candidate reports, and impose profiling duties on AI-assisted hiring.
Per Ogletree Deakins, Governor Matt Meyer signed amendments to the Delaware Personal Data Privacy Act on September 2, 2026, with an effective date of January 1, 2027. Two changes matter most for major-firm clients. First, coverage thresholds drop sharply: the law reaches those processing personal data of 10,000 or more Delaware residents, or 5,000 where at least 20 percent of revenue comes from selling personal data. Second, while employees remain outside the "consumer" definition, a new "resident" category captures personal data processed in connection with profiling and vendor-produced reports used to decide whether to offer employment opportunities — closing the gap around automated sourcing, screening, and ranking tools used before FCRA-regulated background checks.
Controllers must now contractually require third parties to notify residents of adverse action, describe the data relied on, and offer human review. On request, they must supply within thirty days the underlying data, its source, and the identities of third parties that obtained a report in the prior twenty-four months. Controllers processing data of 50,000 or more Delaware residents in high-risk activity must complete impact assessments, and Delaware treats anti-bias testing of AI tools as relevant to unlawful-discrimination claims. Sensitive data expands to include neural data and health treatment or diagnosis information.
Watch for implementing rules, corrective amendments, and copycat provisions in other states.