On September 2, 2026, Governor Meyer signed into law House Bill 380 which amends the Delaware Personal Data Privacy Act (“DPDPA”) that was enacted in 2023.  The amendments will go into effect on January 1, 2027.

Thresholds  Lowered

Originally, the Act applied to persons conducting business in Delaware or producing products or services targeting residents and:

  1. Controlled or processed the personal data of not less than 35,000 consumers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction; or
  2. Controlled or processed the personal data of not less than 10,000 consumers and derived more than 20 percent of their gross revenue from the sale of personal data.

The amendments reduce the number of consumers in paragraph one to 10,000, and the number of consumers in paragraph two to 5,000.  Additionally, the Act will now apply to “third parties who acquire personal data from a controller.”

Entity-Level GLBA Exemption Removed; Data-Level Exemption Intact

The Act originally provided an exemption for financial institutions or affiliates subject to the Gramm-Leach-Bliley Act (“GLBA”), and separately exempted data subject to the GLBA.  The amendments remove the entity-level GLBA exemption and create a new exemption for banks, credit unions, and savings associations.  The data-level GLBA exemption remains unchanged.

Consumer Rights Expanded

The current Act allows a consumer to obtain a list of categories of third parties to which a controller disclosed the consumer’s personal data.  The amendments allow the consumer to receive a list of the third parties themselves to which the consumer’s personal data was disclosed unless: 1) the data is pseudonymized; 2) the controller cannot compile the list, in which case the controller must disclose all third parties with which it disclosed personal data; or 3) the listing would reveal a trade secret.

Contractual Requirements for Third Parties Created

The Act requires a contract between a controller and a processor to contain specific provisions.  The amendments address the contract between a controller and a third party, and require that it:

  1. Specify that the personal data is sold or disclosed by the controller only for limited and specified purposes;
  2. Obligate the third party to comply with the Act and provide the same level of privacy protection as the controller.
  3. Grant the controller rights to ensure the third party uses the personal data in a manner consistent with the controller’s obligations;
  4. Require the third party to notify the controller determines it can no longer meet its obligations under the law; and
  5. Grant the controller the right to take steps to stop and remediate unauthorized use of personal data.

New Requirements for Automated Decisions Creating Legal or Similarly Significant Effects

Current law requires controllers to conduct data protection assessments under certain circumstances.  The amendments require that a controller also conduct an impact assessment if “engaging in profiling in furtherance of automated decision that produce legal or similarly significant effects concerning a consumer.”

Additionally, if a controller discloses a report to a third party for use “in connection with any decision that produces legal or similarly significant effects,”  there must be a contract requiring the third party to:

  1. Provide notice to a resident of any adverse action that is based on the report;
  2. Provide a description of the personal data relied upon in making the adverse action;
  3. Include a statement that the resident may obtain certain decision-related information from the controller;
  4. Include a statement that the resident may request that the third party perform a human review of the adverse action.

Among numerous other changes, the amendments also address the sale of sensitive personal data, data minimization, and due diligence when disclosing personal data to a third party.

This Member Alert is intended for members of the Receivables Management Association International, is for informational purposes only, and is in no way intended to provide legal advice. Members are encouraged to consult with an attorney of their choice for legal advice concerning this matter.