Delaware Personal Data Privacy Act (DPDPA) Compliance - 35,000 Consumers Now, 10,000 in 2027, 45 Days
The Delaware Personal Data Privacy Act already reaches companies at 35,000 Delaware residents with no revenue floor, and HB 380, signed on September 2, 2026, cuts that to 10,000 on January 1, 2027, the lowest headcount trigger of any comprehensive state privacy law. A verified request starts a 45-day clock and the cure period is gone. Obtainer finds where a person's data lives across your systems, compiles one reviewable manifest, drafts the response, and tracks the deadline.
found
scanned
Assembling the cover letter from the template...
Helps you comply, not legal advice
In short
The Delaware Personal Data Privacy Act (DPDPA) took effect January 1, 2025. It applies to a controller that conducts business in Delaware or targets Delaware residents and, in the preceding calendar year, either controlled or processed the personal data of at least 35,000 Delaware consumers, excluding data used solely to complete a payment transaction, or controlled or processed the data of at least 10,000 consumers while deriving more than 20 percent of gross revenue from selling personal data. Delaware sets no revenue floor, and 35,000 is among the lowest headcount thresholds of the comprehensive state laws, which matters because Delaware's population is small: a consumer app with national reach can cross it without ever thinking about Delaware. The law is also unusual in covering many nonprofits and higher education institutions that other states exempt. Delaware consumers can confirm and access their personal data, correct inaccuracies, delete it, obtain a portable copy, get a list of the categories of third parties the controller has disclosed their data to, and opt out of sale, targeted advertising, and profiling. You generally must respond within 45 days, extendable once by another 45 days with notice, with a 60-day appeal window on denials. Universal opt-out signals such as Global Privacy Control have been mandatory since January 1, 2026. The 60-day right to cure expired on December 31, 2025, so from January 1, 2026 the Delaware Department of Justice decides on its own whether to offer one. Civil penalties reach $10,000 per violation, and the department can also seek injunctive relief, restitution, and disgorgement. HB 380 is now law: Governor Meyer signed it on September 2, 2026, and from January 1, 2027 the general threshold drops from 35,000 to 10,000 consumers and the sale-based threshold from 10,000 to 5,000, with expanded sensitive-data categories, consent for minors aged 13 to 18, required terms in third-party contracts, and a narrower financial institution exemption. Obtainer handles the operational side: intake, discovery of where the person's data lives, a source-system manifest, a drafted deadline-safe response, and 45-day tracking. Nothing is disclosed or erased automatically; a human reviews, redacts, and approves. Obtainer helps you comply. It is not legal advice, so scope and exemption calls stay with your team. Self-serve from $34/mo.
Why it fits
Delaware businesses, nonprofits, and higher education institutions, plus any national SaaS, ecommerce, or consumer app that crosses 35,000 Delaware residents today or 10,000 from January 1, 2027, a far lower bar than the 100,000-consumer thresholds in most other states.
A low threshold that drops to 10,000 in 2027
Thirty-five thousand Delaware consumers with no revenue floor is already one of the easiest comprehensive state privacy laws to fall under, and Delaware's small population means the share of your user base that trips it is tiny. HB 380, signed on September 2, 2026, cuts the trigger to 10,000 consumers on January 1, 2027, or 5,000 for companies earning 20 percent or more of revenue from selling data. Companies that ruled Delaware out on volume should recount now.
No cure period since January 2026
The DPDPA's 60-day right to cure expired on December 31, 2025. Since January 1, 2026 the Delaware Department of Justice can act without offering you a chance to fix the problem first, and penalties reach $10,000 per violation alongside injunctive relief, restitution, and disgorgement. The first missed 45-day deadline is now the violation rather than a warning.
Nonprofits and universities are in scope
Most state privacy laws exempt nonprofits outright. Delaware does not: it covers nonprofits with only narrow carve-outs, and it covers institutions of higher education for a subset of obligations. If you run a university, an association, or a nonprofit that assumed state privacy law did not reach you, Delaware and Oregon are the two that do, and both expect a real request workflow.
Reference
Delaware DPDPA today and from January 1, 2027 under HB 380
HB 380 was signed on September 2, 2026 and changes most of the numbers a compliance team plans around. This is the side by side view of the rules that apply through December 31, 2026 and the ones that apply from January 1, 2027, based on published summaries of the enrolled bill.
| Rule | Through December 31, 2026 | From January 1, 2027 | What to do now |
|---|---|---|---|
| General threshold | 35,000 Delaware consumers, payment-only data excluded | 10,000 Delaware consumers | Recount Delaware residents in your CRM, product database and mailing lists before year end |
| Sale-based threshold | 10,000 consumers and more than 20 percent of revenue from selling data | 5,000 consumers and 20 percent or more of revenue from selling data | Data brokers and ad-funded apps should assume they are covered |
| Sensitive data | Existing categories such as health diagnosis, precise geolocation, genetic and biometric data | Adds national origin, health treatment or status, neural data and financial account credentials | Tag these fields so a discovery pass finds them in every system |
| Minors aged 13 to 18 | No separate teen consent rule | Consent before targeted ads, sale or significant profiling where you know or willfully disregard age | Flag known teen accounts so their requests are routed correctly |
| Third-party contracts | Processor contract duties only | Required terms for third parties that receive data, including in a sale or for targeted ads | Pull every data-sharing agreement and check it against the new terms |
| Financial institution exemption | Broad GLBA entity-level exemption | Narrowed to specified financial institutions and affiliates | Fintechs that relied on the GLBA carve-out should rerun the analysis |
| Response clock and cure | 45 days plus one 45-day extension, 60-day appeal, no cure period since January 1, 2026 | No change to the 45-day clock reported in published summaries | Track every request against the 45-day date with the deadline tracker |
More use cases
Related features
Questions
Common questions about this
Who must comply with the Delaware Personal Data Privacy Act?
A controller doing business in Delaware or targeting Delaware residents that, in the preceding calendar year, processed the personal data of at least 35,000 Delaware consumers, excluding payment-transaction-only data, or processed the data of at least 10,000 consumers while deriving more than 20 percent of gross revenue from selling personal data. There is no revenue threshold, and unlike most states, many nonprofits and higher education institutions are covered rather than exempt. From January 1, 2027, under HB 380, the thresholds fall to 10,000 consumers, or 5,000 with 20 percent or more of revenue from data sales.
Does Delaware still have a cure period?
No. The DPDPA gave controllers a 60-day right to cure through December 31, 2025. Since January 1, 2026 the Delaware Department of Justice has full discretion over whether to offer an opportunity to cure before enforcing, so it is no longer something you can rely on. Civil penalties reach $10,000 per violation, and the department can also seek injunctive relief, restitution, and disgorgement.
What is Delaware HB 380 and when does it take effect?
HB 380 amends the DPDPA. The General Assembly passed it on June 16, 2026, Governor Meyer signed it on September 2, 2026, and it takes effect January 1, 2027. It lowers the general threshold from 35,000 to 10,000 consumers and the sale-based threshold from 10,000 to 5,000, adds national origin, health status, neural data and financial account credentials to sensitive data, requires consent before targeted ads or sale for known minors aged 13 to 18, sets required terms for third-party contracts, and narrows the financial institution exemption.
How long do I have to respond to a Delaware data subject request?
Forty-five days from receipt of a verified request, extendable once by another 45 days when reasonably necessary if you notify the consumer of the extension and the reason inside the original window. If you deny a request you must explain why and provide an appeal mechanism, and you have 60 days to respond to the appeal. That matches the 45-day standard used by eighteen of the twenty comprehensive state privacy laws, with Iowa at 90 days and Florida capping its extension at 15.
Run a data subject access request end to end
Obtainer finds where a person's data lives across your systems, compiles it into one manifest, drafts the deadline-safe response, and tracks the GDPR and CCPA clock. You review, redact, and approve what gets disclosed. Helps you comply; not legal advice.