---
jurisdiction: "Delaware"
slug: delaware
countryCode: US
snapshotAsOf: "2026-06-12"
lastReviewed: "2026-06-06"
canonicalUrl: https://openagreements.org/legal/privacy/delaware
license: CC BY 4.0
stale: false
---

> [!IMPORTANT]
> **Informational only — not legal advice.** This is a snapshot of an OpenAgreements practice note,
> provided for general information. It is not legal advice, does not create an attorney-client
> relationship, and is not a substitute for a licensed attorney in the relevant jurisdiction.
> Laws change; verify against the canonical version before relying on it.
>
> **Canonical:** https://openagreements.org/legal/privacy/delaware · **Snapshot as of:** 2026-06-12 · License: CC BY 4.0 · © UseJunior

# Delaware Consumer Privacy Law (DPDPA)[^about]

The Delaware Personal Data Privacy Act gives Delaware residents rights over their personal data and imposes notice, contracting, and consent duties on controllers above unusually low thresholds — it reaches early-stage startups and most nonprofits, is enforced exclusively by the Delaware Department of Justice, and provides no private right of action.


## At a glance

| Question | Delaware |
| --- | --- |
| **Summary** | If you control or process the data of 35,000 Delaware residents (or 10,000 plus a fifth of revenue from selling data), the DPDPA requires a privacy notice, opt-in consent to process sensitive data, and processor contracts — enforced by the Department of Justice, whose temporary right-to-cure expired at the end of 2025, with no consumer lawsuits. |
| **Main law** | Del. Code tit. 6 §§ 12D-101 et seq. (Delaware Personal Data Privacy Act) |
| **Privacy policy required?** | Yes — a reasonably accessible, clear, and meaningful notice with statutorily fixed contents |
| **Who does it cover?** | Persons doing business in Delaware (or targeting residents) that control or process the data of 35,000+ consumers a year, or 10,000+ while deriving more than 20% of gross revenue from selling data — no revenue floor, and only insurance-crime nonprofits are exempt |
| **Can consumers sue?** | No — enforcement belongs solely to the Delaware Department of Justice |
| **Who enforces it?** | Delaware Department of Justice (exclusive) |

## Does the Delaware Personal Data Privacy Act apply to your business? {#does-dpdpa-apply}

**Short answer.** It turns on how many Delaware residents you reach, not how much money you make. The DPDPA applies to persons that do business in Delaware or target its residents and that, in the prior calendar year, controlled or processed the personal data of at least 35,000 consumers, or at least 10,000 consumers while deriving more than 20% of gross revenue from selling personal data [^stat-103-apply].

The thresholds here are among the lowest in the country, and there is no dollar revenue floor — so an early-stage, pre-revenue startup that simply touches 35,000 Delaware residents is covered. Delaware is also unusually broad on nonprofits: rather than exempting them as a class, it carves out only a nonprofit dedicated exclusively to preventing and addressing insurance crime, so most charitable and trade organizations fall within the law. A consumer is a Delaware resident acting in a personal or household context, not an employee or a business-to-business contact. State agencies, GLBA-regulated financial institutions, and certain federally regulated data remain excluded.

## What must your Delaware privacy policy contain? {#privacy-policy-contents}

**Short answer.** A controller must provide a reasonably accessible, clear, and meaningful privacy notice that lists the categories of personal data processed, the purpose for processing, how consumers exercise and appeal their rights, the categories of personal data shared with third parties, the categories of those third parties, and a way to contact the controller [^stat-106-notice].

Section 12D-106(c) is the content checklist for a Delaware privacy policy. The DPDPA also requires data minimization — collection limited to what is adequate, relevant, and reasonably necessary — and, where a controller sells personal data or processes it for targeted advertising, a clear and conspicuous disclosure of that practice and how to opt out. As of January 1, 2026, the opt-out mechanism must also honor a universal opt-out preference signal such as Global Privacy Control. The notice the policy presents should match the data practices the controller actually carries out.

## What must your contracts with processors say? {#vendor-contracts}

**Short answer.** A binding contract must govern any processor's handling of personal data on the controller's behalf — so a data processing agreement is a statutory requirement, not a best practice — and that contract must set out the processing instructions, the nature and purpose of processing, the type of data, the duration, and the rights and obligations of both parties [^stat-107-contract].

Section 12D-107(b) then layers in the required processor commitments: a duty of confidentiality for everyone handling the data, deletion or return of data at the controller's direction, the information needed to demonstrate compliance, advance notice before engaging a subcontractor (which must be bound by written contract to the same obligations), and cooperation with reasonable assessments. A compliant template DPA tracks each of these.

## Do you need consent to process sensitive data? {#sensitive-data}

**Short answer.** Yes. A controller may not process a consumer's sensitive data without first obtaining consent, and for a known child it must instead obtain a parent's or guardian's consent and otherwise comply with Delaware's children's-data provisions [^stat-106-consent]. Sensitive data covers data revealing race or ethnicity, religious beliefs, a mental or physical health condition or diagnosis, sex life, sexual orientation, transgender or nonbinary status, or citizenship or immigration status; genetic or biometric data; the personal data of a known child; and precise geolocation [^stat-102-sensitive].

This is the opt-in model that the Virginia-family privacy laws share — consent must be a freely given, specific, informed, and unambiguous affirmative act, and it cannot be manufactured through buried terms of use or dark patterns. Delaware also goes further than some peers for teenagers: a controller cannot run targeted advertising on, or sell the data of, a consumer it knows to be at least 13 but under 18 without that consumer's consent.

## Can a consumer sue your business under the DPDPA? {#consumer-lawsuit}

**Short answer.** No. The DPDPA gives the Delaware Department of Justice exclusive enforcement authority and expressly forecloses any private right of action [^stat-111-enforce]. The law's right-to-cure was temporary: through the end of 2025 the Department had to issue a notice and allow 60 days to fix a curable violation, but that mandatory cure period applied only to the period ending December 31, 2025 [^stat-111-cure].

Unlike Virginia's permanent cure period, Delaware's sunset on January 1, 2026. Since then, whether to offer a controller a chance to cure is left to the Department's discretion, weighed against factors such as the number of violations and the likelihood of injury to the public — so a covered business can no longer count on a guaranteed off-ramp. The practical posture is to build the notice, consent, and contracting controls up front rather than rely on a cure window that may not be offered.

[^about]: By Steven Obiajulu, J.D. Published by [openagreements.org](https://openagreements.org) · Maintained by [UseJunior](https://usejunior.com). Last reviewed 2026-06-06. License: CC BY 4.0. Steven Obiajulu, J.D. is admitted in New York, not Delaware. This article synthesizes Delaware primary law and is not legal advice from a Delaware-admitted attorney. This article is for informational purposes only and does not create an attorney-client relationship.

[^stat-103-apply]: **Del. Code tit. 6 § 12D-103** — "This chapter applies to persons that conduct business in the State or persons that produce products or services that are targeted to residents of the State and that during the preceding calendar year did any of the following: (1) Controlled or processed the personal data of not less than 35,000 consumers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction. (2) Controlled or processed the personal data of not less than 10,000 consumers and derived more than 20% of their gross revenue from the sale of personal data." *Del. Code tit. 6 § 12D-103(a).* <https://delcode.delaware.gov/title6/c012d/index.html>

[^stat-106-notice]: **Del. Code tit. 6 § 12D-106** — "A controller shall provide consumers with a reasonably accessible, clear, and meaningful privacy notice that includes all of the following: (1) The categories of personal data processed by the controller. (2) The purpose for processing personal data." *Del. Code tit. 6 § 12D-106(c).* <https://delcode.delaware.gov/title6/c012d/index.html>

[^stat-107-contract]: **Del. Code tit. 6 § 12D-107** — "A contract between a controller and a processor must govern the processor’s data processing procedures with respect to processing performed on behalf of the controller. The contract must be binding and clearly set forth instructions for processing data, the nature and purpose of processing, the type of data subject to processing, the duration of processing and the rights and obligations of both parties." *Del. Code tit. 6 § 12D-107(b).* <https://delcode.delaware.gov/title6/c012d/index.html>

[^stat-106-consent]: **Del. Code tit. 6 § 12D-106** — "Not process sensitive data concerning a consumer without obtaining the consumer’s consent, or, in the case of the processing of sensitive data concerning a known child, without first obtaining consent from the child’s parent or lawful guardian and otherwise complying with § 1204C of this title." *Del. Code tit. 6 § 12D-106(a)(4).* <https://delcode.delaware.gov/title6/c012d/index.html>

[^stat-102-sensitive]: **Del. Code tit. 6 § 12D-102** — "‘Sensitive data’ means personal data that includes any of the following: a. Data revealing racial or ethnic origin, religious beliefs, mental or physical health condition or diagnosis (including pregnancy), sex life, sexual orientation, status as transgender or nonbinary, citizenship status, or immigration status. b. Genetic or biometric data. c. Personal data of a known child. d. Precise geolocation data." *Del. Code tit. 6 § 12D-102(30).* <https://delcode.delaware.gov/title6/c012d/index.html>

[^stat-111-enforce]: **Del. Code tit. 6 § 12D-111** — "Nothing in this chapter shall be construed as providing the basis for, or be subject to, a private right of action for violations of said sections or any other law." *Del. Code tit. 6 § 12D-111(d).* <https://delcode.delaware.gov/title6/c012d/index.html>

[^stat-111-cure]: **Del. Code tit. 6 § 12D-111** — "During the period beginning on January 1, 2025, and ending on December 31, 2025, the Department of Justice shall, prior to initiating any action for a violation of any provision of this chapter, issue a notice of violation to the controller if the Department of Justice determines that a cure is possible. If the controller fails to cure such violation within 60 days of receipt of the notice of violation, the Department of Justice may bring an enforcement proceeding pursuant to subsection (a) of this section." *Del. Code tit. 6 § 12D-111(b).* <https://delcode.delaware.gov/title6/c012d/index.html>
