Cybersecurity Policy Report, Updated Data Breach Requirements Signed by Delaware Governor, (Sep 8, 2026)
Delaware Gov. Matt Meyer (D.) has signed into law a bill to expand the state’s data breach law to better inform the state Department of Justice’s Fraud and Consumer Protection Division of security breaches.
Under the new law (HB 381), businesses will also be required to provide notice to the attorney general’s office within 60 days of the determination of a breach. Currently, the attorney general’s office is informed only when a security breach affects more than 500 Delaware residents.
The bill further revises the definition of “notice” to explicitly require that, in cases where substitute notice is used due to high costs, large numbers of affected residents, or insufficient contact information, notification must also be provided to the attorney general.
Rep. Krista Griffith (D.), sponsor of the bill (H.B. 381, Reg Sess.), said the measure was intended to “strengthen transparency and accountability requirements when sensitive information is exposed.”
News: StateLegislation DataPrivacy DataBreach