US — DelawareDelaware Personal Data Privacy Act (DPDPA): Complete Compliance Guide
What the Delaware Personal Data Privacy Act requires from January 1, 2027: lower thresholds, broader sensitive data rules, and new duties for third parties and profiling.
What Is the Delaware Personal Data Privacy Act (DPDPA)?
The Delaware Personal Data Privacy Act (DPDPA) is Delaware’s consumer privacy law, in force since January 1, 2025 and amended by House Bill 380 from January 1, 2027. It applies to businesses that operate in Delaware or target Delaware residents and, in the preceding calendar year, processed personal data of at least 10,000 consumers, or at least 5,000 consumers while earning more than 20% of gross revenue from selling personal data. It also covers third parties that acquire personal data from a controller. Consumers can access, correct, delete and port their data, get a list of third parties that received it, and opt out of targeted advertising, sales and profiling. The Delaware Department of Justice enforces the law.
The sections below show the combined requirements of all the laws that apply in this jurisdiction.
Does the Delaware Personal Data Privacy Act Apply to Your Business?
The DPDPA applies to businesses that meet at least one of its thresholds. Use this tool to check whether it applies to yours.
Delaware Personal Data Privacy Act Scope Checker
Answer two questions to determine whether the DPDPA applies to your organization.
Note: the DPDPA applies based on Delaware residents' data, regardless of where your business is located.
Delaware Personal Data Privacy Act Compliance Checklist
Review each category to assess your DPDPA readiness.
DPDPA Compliance Checklist
Download the DPDPA Compliance Checklist
Get a clean, printable PDF of all 35 action items — share it with your legal team, use it in a compliance audit, or brief your board on what still needs to be done.
What Is the Delaware Personal Data Privacy Act (DPDPA)?
The Delaware Personal Data Privacy Act (DPDPA) is Delaware’s comprehensive data privacy law, signed by Governor John Carney on September 11, 2023 and effective January 1, 2025. It applies to businesses that operate in Delaware or target Delaware residents and process the personal data of a minimum number of consumers. House Bill 380 lowers those thresholds from January 1, 2027 to 10,000 consumers, or 5,000 consumers when more than 20% of gross revenue comes from selling personal data.
Under the Delaware Data Privacy Act, consumers can access, correct, delete and port their personal data, get a list of the specific third parties that received it, and opt out of targeted advertising, data sales and profiling. The Delaware Department of Justice enforces the law; there is no private right of action.
One of the DPDPA’s most distinctive features is its reach. Unlike most state privacy laws, it applies to nonprofit organizations, and from 2027 it also covers third parties that acquire personal data from a controller. Since January 1, 2026, businesses must honor universal opt-out signals such as Global Privacy Control (GPC), and the 60-day cure period expired at the end of 2025.
Delaware Consumer Rights Under the DPDPA
The DPDPA grants eight individual privacy rights to Delaware residents. Businesses must respond to authenticated requests within 45 days. A 45-day extension is available with written notice to the consumer.
Request access to the information we have collected about you
45-day response windowCorrect inaccurate or incomplete information we have collected about you
45-day response windowDelete personal information we have collected about you
45-day response windowRequest a copy of personal information we have collected about you
45-day response windowLet us know that you don't want us to process your personal information
45-day response windowOpt-out of targeted advertisements so that you no longer receive personalized ads
45-day response windowRequest that we stop selling your personal information
45-day response windowRequest that we limit how your personal information being used
45-day response windowDelaware Personal Data Privacy Act Penalties and Enforcement
Consumers cannot sue businesses directly under the DPDPA.
Per individual DPDPA violation.
Businesses must respond to verified consumer requests within 45 days. Failure is a violation that can trigger enforcement.
The time a business has to fix a violation after being notified, before penalties apply.
How Clym Helps You Comply with the Delaware Personal Data Privacy Act
Clym detects browser-based Global Privacy Control signals and automatically applies opt-out status — no extra configuration needed from your dev team.
Configurable consent banner with clear choices for every cookie category, and a full consent audit log.
Clym's Data Subject Request portal handles every DPDPA request type, with built-in 45-day deadline tracking and escalation alerts.
Clym scans your site and generates your DPDPA-compliant privacy notice, updated automatically when new trackers or data categories are detected.