Cybersecurity Policy Report, Legislation to Strengthen Data Privacy Law Advances in Delaware, (Jun 17, 2026)
The Delaware state Senate voted 15-6 this week in support of a bill to amend the Delaware Personal Data Privacy Act to expand consumer rights, lower applicability thresholds, strengthen protections for sensitive data, and require stricter contracts and due diligence for data sharing.
HB 380 would lower the applicability threshold, making the law apply to entities that process the personal data of at least 10,000 consumers (down from 35,000) or 5,000 consumers if more than 20% of gross revenue is derived from selling personal data and includes third parties acquiring personal data.
The bill would also expand definitions of sensitive data to include neural data, financial account information, and government-issued IDs and clarify that biometric data collected without consent was not considered publicly available information.
The bill also would impose additional terms on contractual agreements and due diligence when controllers disclose or sell personal data to third parties. According to the bill, these contracts must specify the purposes of data use, require third parties to comply with the privacy law, and grant controllers oversight rights.
In addition, the bill would prohibit the processing of personal data of a consumer when the controller has actual knowledge that the consumer is a child. HB 380 has an effective date of Jan. 1, 2027.
The bill (H.B. 380, Reg Sess.) is sponsored by Sen. Marie Pinkney (D.).
News: StateLegislation DataPrivacy