recordinglaw.com · Recording Law · September 5, 2026
Delaware Signs HB 380: DPDPA Privacy Overhaul Effective 2027 | Recording Law
# Delaware Signs HB 380: DPDPA Privacy Overhaul Effective 2027
Independently fact-checked By Recording Law Editorial Team· Published September 5, 2026 27 min read
Independently fact-checked against primary sources (last audited September 5, 2026). · 7 primary sources cited on this page. How we verify our legal content
## Key Takeaways
- 1 Delaware: Governor Matt Meyer signed House Bill 380 on September 2, 2026. The bill detail page lists it as Chapter 463 of Volume 85 of the Laws of Delaware with an effective date of January 1, 2027. Copy this fact with its source - 2 The coverage threshold at 6 Del. C. 12D-103(a)(1) drops from 35,000 Delaware consumers to 10,000, and the revenue-based trigger at 12D-103(a)(2) drops from 10,000 consumers to 5,000 where more than 20 percent of gross revenue comes from selling personal data. Copy this fact with its source - 3 Sensitive data grows to include neural data, financial account credentials and government-issued identification numbers, and for the first time reaches inferences that are used to reveal or identify a sensitive category. Copy this fact with its source - 4 A new subsection 12D-106(f) requires adverse-action notice, a description of the data relied on, and an opportunity to ask for human review whenever a controller hands a third party a report used in a decision with legal or similarly significant effects. Copy this fact with its source - 5 The profiling opt-out at 12D-104(a)(6)c. loses the word solely, so it reaches automated decisions that still include a human step. Copy this fact with its source - 6 Delaware's employment and applicant data carve-out narrows: HR data comes back inside the statute when it is processed in connection with profiling and reports under 12D-106(f). Copy this fact with its source - 7 Enforcement remains with the Delaware Department of Justice alone. Section 12D-111(d), which bars a private right of action, is not amended by House Bill 380. Copy this fact with its source
## Delaware Signs HB 380: DPDPA Privacy Overhaul Effective 2027
Delaware Governor Matt Meyer signed House Bill 380 on September 2, 2026, rewriting the Delaware Personal Data Privacy Act. The law cuts the coverage threshold from 35,000 consumers to 10,000, expands sensitive data to include neural data, and takes effect January 1, 2027.
> Information last verified on September 5, 2026.
> Status: House Bill 380 of the 153rd General Assembly, as amended by House Amendment No. 2, was signed on September 2, 2026 and assigned Chapter 463 of Volume 85 of the Laws of Delaware. Its effective date is January 1, 2027. Until that date, the Delaware Personal Data Privacy Act as currently codified at Chapter 12D of Title 6 of the Delaware Code remains the operative law, unchanged.
> Jurisdiction: This article describes Delaware law only. House Bill 380 amends the Delaware Personal Data Privacy Act at Chapter 12D of Title 6 of the Delaware Code. It is not the California Consumer Privacy Act, and it does not change the privacy statute of any other state or any federal privacy law.
## What Happened
On September 2, 2026, Governor Matt Meyer signed House Bill 380, an act to amend Title 6 of the Delaware Code relating to personal data privacy. The Delaware General Assembly's bill detail page records the status line as signed on September 2, 2026, assigns the act to Volume 85, Chapter 463 of the Laws of Delaware, gives it Governor's Advisory Number 57, and lists an effective date of January 1, 2027 with no sunset date.
The bill was introduced on April 16, 2026 by Representative Krista Griffith, with Senator Marie Pinkney among the additional sponsors and a long list of House and Senate co-sponsors. The version that became law is the engrossed text, described on its face as House Bill No. 380 as amended by House Amendment No. 2. The General Assembly's fiscal note field reads "Not Required."
Governor Meyer signed a second privacy measure the same day. House Bill 381 amends Chapter 12B of Title 6, Delaware's computer security breach chapter, and is recorded on its own bill detail page as signed on September 2, 2026, assigned Chapter 464 of Volume 85, with an effective date of September 2, 2026. That bill took effect immediately on signature; House Bill 380 did not.
The Governor's office announced the two bills together, describing them as creating "the broadest data protections in the country." The announcement states that the package sets "the lowest threshold in the nation," under which a company handling the data of 10,000 consumers falls within the law. That comparative claim is the Governor's office's characterization; this article does not independently rank Delaware's threshold against every other state comprehensive privacy statute.
## What the Law Actually Says
The Delaware Personal Data Privacy Act, enacted in 2023 as 84 Del. Laws c. 197, currently reaches a business that conducts business in Delaware or targets products or services to Delaware residents and, in the preceding calendar year, controlled or processed the personal data of at least 35,000 consumers, or of at least 10,000 consumers while deriving more than 20 percent of gross revenue from selling personal data. That remains the law through December 31, 2026. Our plain-language explainer of how the DPDPA works right now describes the statute as currently codified, not the version that arrives on January 1, 2027.
Everything below is the text that survives in the engrossed bill, meaning existing language the bill leaves alone plus language it inserts. Where the bill deletes language, that is said explicitly.
### Definitions in Section 12D-102
Sensitive data gets a new opening clause and three new categories. It will read "personal data that includes any of the following, and includes inferences made based on personal data, alone or in combination with other data, that are used to reveal or identify any of the following." That inference clause is new: a conclusion drawn about a person becomes sensitive when it is used to reveal or identify a listed attribute, not just the underlying data.
The first listed category is rewritten. It currently reads "Data revealing racial or ethnic origin, religious beliefs, mental or physical health condition or diagnosis (including pregnancy), sex life, sexual orientation, status as transgender or nonbinary, citizenship status, or immigration status." On January 1, 2027 it reads "Data that reveals or identifies racial, national, or ethnic origin, religious beliefs, mental or physical health condition, diagnosis, treatment, or status (including pregnancy), sex life, sexual orientation, treatment or status as transgender or nonbinary, citizenship status, or immigration status." National origin is added, treatment and status join health condition and diagnosis, and treatment status is added alongside status as transgender or nonbinary. Citizenship and immigration status were already in the 2023 statute and are carried forward, not newly added.
Three categories are inserted outright: neural data "that is generated by measuring the activity of an individual's central nervous system"; financial account numbers, account log-in information, and card numbers that, alone or in combination with any required access or security code, password, or credential, would allow access to a financial account; and government-issued identification numbers, including Social Security, passport, state identification card, and driver's license numbers, that applicable law does not require to be publicly displayed. Genetic and biometric data, personal data of a known child, and precise geolocation data stay sensitive as they are now.
Three definitions are entirely new. Adverse action means "any denial, cancellation, unfavorable change, increase in charge, exclusion of benefit, or other action adverse to the interests of a consumer or resident in connection w