Governance, risk & compliance

Delaware Personal Data Privacy Act (DPDPA) 6 Del. C. ch. 12D; in force 1 Jan 2025; amended text from 1 Jan 2027

The Delaware Personal Data Privacy Act is Title 6, Chapter 12D of the Delaware Code (84 Del.

Laws c. 197), in force from 1 January 2025 (date inferred from the 2025 dates in the Code; the session law was not read).

Until 31 December 2026 it applies to businesses handling the personal data of 35,000 consumers, or 10,000 consumers with over 20% of revenue from sale, and nonprofits are generally covered. Consumers can access, correct and delete data, take a copy, get a list of the third parties that received it, and opt out of targeted advertising, sale and certain profiling.

Sensitive data needs opt-in consent, consent must be as easy to withdraw as to give, and opt-out preference signals have been required since 1 January 2026. Teens aged 13 to 17 cannot be targeted or sold to without consent.

Assessments are due for processing created on or after 1 July 2025. The Department of Justice enforces; the mandatory 60-day cure ended on 31 December 2025 and cure is now discretionary.

The Code already carries a second text from 1 January 2027 (85 Del. Laws c.

463, reported as HB 380): thresholds fall to 10,000 and 5,000 consumers, third parties are covered, data minimization becomes reasonably necessary and proportionate, sensitive data sales are tightly limited, and impact assessments for profiling begin. Both texts are mapped and labelled by date.

Not read: the session laws and the penalty amounts. General information, not legal advice.

Assessment tiers & levels Lavawall supports

Lavawall assesses Delaware Personal Data Privacy Act (DPDPA) at every level below, so you can start where you are and step up as your program matures.

How Lavawall® helps you get to Delaware Personal Data Privacy Act (DPDPA) compliance

Most of Delaware Personal Data Privacy Act (DPDPA) comes down to technical controls you have to run and prove: keeping systems patched, hardening configuration, detecting breaches early, backing up what matters, controlling access, and keeping evidence that all of it actually happened. Lavawall® runs those controls across Windows, macOS, Linux, and Microsoft 365 / Google Workspace from one console, maps them to Delaware Personal Data Privacy Act (DPDPA), and tracks your posture continuously instead of once a year at audit time.

• Assess your current state against Delaware Personal Data Privacy Act (DPDPA) in the Lavawall GRC module, with the questionnaire and control set built in.
• Remediate the gaps with the same platform — automated patching, configuration fixes, backups, and access review — not a separate project.
• Evidence everything with timestamped, exportable records auditors, insurers, and clients accept.

Related

Lavawall® supports Delaware Personal Data Privacy Act (DPDPA) as part of a built-in catalogue of compliance frameworks. Framework requirements are summarized for planning purposes; always confirm the current official text before certifying.