Delaware Personal Data Privacy Act: What Businesses Need To Know

On September 11, 2023, Delaware Governor John Carney signed House Bill No. 154, referred to as the Delaware Personal Data Privacy Act (DPDPA), into law. With the passage of the DPDPA, Delaware became the thirteenth state to adopt a comprehensive consumer data privacy law, joining California, Virginia, Colorado, Connecticut, Utah, Iowa, Indiana, Tennessee, Montana, Florida, Texas, and Oregon. The DPDPA becomes effective on January 1, 2025.

Similar to other state privacy laws, the DPDPA provides the state's residents with comprehensive privacy protections and grants them new rights regarding their personal data. At the same time, the DPDPA introduces distinctive elements that set it apart from other state privacy laws. These include applicability to most nonprofit organizations (similar only to Colorado's and Oregon's privacy laws) and institutions of higher education, and an expanded definition of sensitive personal data. These specific attributes of the Delaware law