Delaware legislature passes HB 380 amending state privacy law

What happened

- Delaware House passed HB 380 on 2 September 2026, amending the Delaware Personal Data Privacy Act. - The amendments impose new obligations on data controllers, processors and third‑party service providers. - Requirements include expanded consumer consent, detailed data mapping, and third‑party contract disclosures. - Entities must adjust compliance programs to meet the new statutory duties.

Why it matters

Businesses that collect or process Delaware residents' personal data now face tighter consent and transparency rules, mirroring trends in other state privacy regimes. Review existing data‑handling practices to ensure they meet the expanded obligations.

Business impact

Compliance teams will need to allocate resources for consent management upgrades and third‑party contract reviews, potentially increasing operational costs.

What to check

1. 1

   Update consent mechanismsHigh priority

   Implement processes to obtain and document explicit consumer consent as required by HB 380.

2. 2

   Conduct data‑mapping auditMedium priority

   Map all personal data flows to identify gaps with the new data‑mapping obligations.