Delaware governor signs HB 380 to update personal data privacy act

What happened

• HB 380 was enacted on 2 September 2026, adding new consumer consent requirements and expanding data breach notification timelines.
• The amendment aligns Delaware’s law with trends seen in other state privacy statutes.
• The revised DPDPA now includes clearer definitions of personal data and imposes higher penalties for non‑compliance.
• The law takes effect 90 days after the governor’s signature.

Why it matters

Enterprises operating in Delaware must review the updated consent and breach‑notification provisions to avoid penalties and ensure alignment with the refreshed statutory language.

Business impact

The changes increase compliance workload for businesses handling Delaware residents’ data, potentially requiring updates to privacy notices, consent mechanisms, and incident‑response plans.

What to check

1. 1

   reviewHigh priority

   Compare current privacy practices against the new consent requirements in HB 380.

2. 2

   updateMedium priority

   Revise breach‑notification procedures to meet the shortened reporting timelines.

3. 3

   trainMedium priority

   Educate staff on the expanded definitions of personal data and associated obligations.