Delaware. Breach notification. Act
DE breach lawDelaware data breach notification law (Del. Code tit. 6, § 12B-101 et seq.)
Partly verified
Medium confidence. No verification notes recorded.§1Summary
- Synopsis
Requires businesses (and in most cases public bodies) that own or license computerised personal information about Delaware residents to notify affected individuals after a security breach. Core timing rule: Individuals without unreasonable delay and within 60 days of determining a breach. Covered data: name plus SSN, driver's licence/ID, financial account with codes, passport, online credentials, medical history and DNA profile, health insurance ID, biometric data, taxpayer ID.
- Key themes
- Unique features
One year of free credit monitoring is mandatory when SSNs are breached; also imposes a duty to maintain reasonable security.
- SaaS relevance
A SaaS provider hosting customer data is usually the 'maintaining' entity, not the owner: Delaware requires the maintaining entity to notify and cooperate with the owner immediately after determining a breach. The owner customer then carries the individual and regulator notices, so contracts should fix timelines and cooperation.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- Individuals without unreasonable delay and within 60 days of determining a breach; AG no later than individuals if >500 residents
- DPO
- No
- Cross-border transfers
- None
- Maximum penalty
- AG enforcement under consumer fraud laws; direct economic damages recoverable
§3Dates
- Key dates
- Adopted
- In force
- Overhauled by HS 1 for HB 180 (signed 2017-08-17, eff. 2018-04-14)
§4Text and authority
- Text
- Authoritative text delcode.delaware.gov
- Authority
- Delaware Department of Justice (Attorney General)
§5Where it applies
- Domestic law of
- Delaware
§6Sources and verification
- Sources consulted
- Verification
Medium confidence.
Partly verified
Medium confidence. No verification notes recorded.