As we flagged last month in our mid-year U.S. privacy roundup, the Delaware legislature recently passed House Bill 380 (“HB 380”), which amends the Delaware Personal Data Privacy Act (the “Act”) in ways that impose significant new, and in many ways complex and novel, requirements on controllers, processors and third parties.  On September 2, 2026, Delaware Governor Matt Meyer signed House Bill 380 into law and thus amended what was already a fairly strict state consumer privacy law. These amendments significantly lower the volume-based thresholds for applicability, create new obligations for providers of “reports” used to make certain types of decisions and businesses that use that data, add new requirements for consumer rights, impose restrictions on profiling job applicants, employees and independent contractors, and require contracts with and obligations from third parties that receive personal data (e.g., sales), among many other changes. These amendments will become effective on January 1, 2027.

Businesses that are subject to the Act (of which there will be many more as a result of HB 380) should carefully review the amended Act to determine their new obligations, including the significant amendments discussed below.  Financial institutions in particular should determine whether they must now comply with the Act, as the broad exemption for financial institutions subject to Title V of the Gramm-Leach-Bliley Act (the “GLBA”) has been replaced by a narrower exemption for only certain types of financial institutions and certain of their affiliates (see discussion below).

The following is a summary of the more material amendments to the Act included in House Bill 380:

Significantly Lower Thresholds for Applicability

Following the enactment of HB 380, far more businesses will be subject to the Act as a result of it lowering the volume-based applicability threshold from 35,000 to 10,000 Delaware residents annually. A business that derives more than 20% of its gross revenue from the sale of personal data will now be subject to the Act if it processes the personal data of more than 5,000 Delaware residents annually, down from 10,000.  Notably, and unlike any other state consumer privacy law, HB 380 provides that “third parties” who acquire personal data from a controller (e.g., through a sale) are now subject to the Act, whether or not the third party or the controller is otherwise subject to the Act. 

This appears to raise a question:  to which of the Act’s obligations will a third party now be subject? Only those obligations specifically imposed on “third parties” under §12D-107A of the Act or those obligations imposed on controllers as well, given that all third parties are also controllers of the personal data received? We believe the best reading of HB 380 is the former, as §12D-107A(g) of the Act provides that “[a] third party subject to this chapter under [the volume-based processing thresholds discussed above] must comply with all provisions of this chapter.” This at least implies that a third party receiving personal data in a sale or other transfer from a controller would not be subject to any controller obligations generally if they did not satisfy such thresholds. While it would have been ideal if HB 380 had stated this explicitly, this appears to be the intent.

Note also that HB 380 lowers the volume-based threshold for a controller’s duty to conduct data protection assessments from 100,000 to 50,000 Delaware residents, excluding payment transactions.

Narrower Exemption for Financial Institutions Subject to the GLBA and for Human Resources Personal Data

When it was enacted, the Act provided for a broad exemption for “any financial institution or affiliate of a financial institution … subject to Title V of the Gramm Leach Bliley Act….”  HB 380 narrows this exemption by limiting it to the following three types of financial institutions:

  • Any insurer, insurance company, insurance producer, surplus lines broker, third-party administrator of self-insurance, health carrier, health services corporation, insurance-support organization, or insurance agent, or any affiliate or subsidiary thereof that is principally engaged in financial activities as described in 12 U.S.C. § 1843(k).
  • Any federal or state-chartered bank, credit union, savings association, or any affiliate or subsidiary thereof that is principally engaged in financial activities as described in 12 U.S.C. § 1843(k).
  • Any agent, broker-dealer, investment adviser, or investment adviser representative who is regulated by the Delaware Investor Protection Unit or the Securities and Exchange Commission.

HB 380 also narrowed the applicability of the Act’s GLBA exemption as it applies to affiliates and subsidiaries of a financial institution.  The Act currently provides that an affiliate of a financial institution was exempt from the Act if it was “subject to” the GLBA.  When the amendments to the Act take effect, only those affiliates and subsidiaries that are “principally engaged in financial activities” under 12 U.S.C. § 1843(k) will be exempt from the Act.  Unfortunately, HB 380 does not define “principally engaged.”

The original Act, like most state consumer privacy laws other than the California Consumer Privacy Act (the “CCPA”), provided that the Act did not apply to “[d]ata processed or maintained In the course of … an individual applying to, employed by, or acting as an agent or independent contractor of a controller, processor, or third party, to the extent that the data is collected and used within the context of that role.”  HB 380, however, adds the following carve-out of this exception: “except for personal data processed in connection with profiling and reports under § 12D-106(f) of this title.”  We discuss the scope and impact of that below.  Prior to this, only the CCPA applied to human resources data (other than the Colorado Privacy Act’s biometric data provisions). 

Changes to Consumer Privacy Rights

Although HB 380 does not add any new fundamental consumer privacy rights, it strengthens multiple existing rights.  For example, the Act’s “right to know” has been expanded to include the right to know whether the controller is processing personal data, now explicitly including inferences, with a specific obligation to disclose if processing for the purpose of profiling to make a decision that produces any legal or similarly significant effect concerning the consumer.

HB 380 also strengthens the right to know to which third parties the controller has disclosed the consumer’s personal data by requiring controllers to provide consumers with a list of the specific third parties to which the controller has disclosed the consumer’s personal data. The Act currently only requires controllers to provide a list of categories of third parties to which the controller has disclosed the consumer’s personal data. HB 380 provides for an exception from this requirement if the controller cannot provide the information without unreasonable effort, in which case the controller must disclose all third parties to which the controller discloses consumers’ personal data (i.e., the list of third parties must still list specific third parties, but the list is not required to be customized to relate to the requesting consumer).

Tightening of the Data Minimization and Purpose Limitation Obligations

Section 12D-106 (a)(1) of the original Act limited “‘collection” of personal data to what was “adequate, relevant and reasonably necessary” for the purpose disclosed to the consumer. The amendments in HB 380 now replace “collection” with processing,” delete “adequate” and “relevant,” and add “proportional.” As amended, subsection (a)(2) applies the same new “reasonably necessary and proportional” standard to the disclosed purposes, at the time of collection, in determining if consent for additional purposes is necessary.

Enhanced Protection for Minors’ Personal Data

HB 380 enhances protections for minors’ personal data by requiring that controllers obtain consumer consent prior to processing personal data for profiling in furtherance of automated decisions that produce legal or similarly significant effects concerning the consumer, targeted advertising, or in connection with the sale of such data, when the controller has actual knowledge that (or willfully disregards whether) the consumer is at least 13 but under 18 years of age.

Requirements for Data Processing Agreements

Similar to requirements found in the CCPA, HB 380 requires controllers to enter into binding contractual agreements with third parties to whom personal data is disclosed (including in a sale of personal data or for targeted advertising), that include the following terms:

  • that the personal data is being sold or disclosed by the controller only for limited and specified purposes, including whether the purpose includes use for decisions that produce legal or similarly significant effects;
  • a requirement that the third party comply with the Act and to provide the same level of privacy protection as is required by the Act;
  • the right of the controller to take reasonable and appropriate steps to ensure that the third party uses the transferred personal data in a manner consistent with the controller’s obligations under the Act;
  • a requirement that the third party to notify the controller if it makes a determination that it can no longer meet its obligations under the Act; and
  • the right of the controller upon notice to take reasonable and appropriate steps to stop and remediate unauthorized use of personal data.

Note that consistent with other state consumer privacy laws, a “third party” is essentially defined to mean any person other than the relevant consumer, the controller of personal data, or a processor or an affiliate of the processor or controller.

Additional obligations for contracts between suppliers of profiling reports and third party report recipients are discussed below.

New Diligence Requirements

HB 380 imposes more detailed diligence requirements for third party recipients of personal data than are found in other state consumer privacy laws.  When HB 380 take effect, controllers will be required to conduct reasonable due diligence of third parties to whom the controller discloses personal data (including the sale of personal data and targeted advertising) to “assess the third party’s policies and technical and organizational measures undertaken to support compliance with the obligations under [the Act] and to demonstrate compliance … as it relates to the personal data that the controller discloses to the third party or that the controller anticipates disclosing to third party.”  HB 380 specifies that “reasonable due diligence” involves, at a minimum, “assessing the third party through the use of questionnaires and review of relevant documents of the third party. Additional reasonable measures must be undertaken in a manner that is commensurate with the sensitivity of the data disclosed by the controller to the processor or third party.”

HB 380 amends the antidiscrimination provisions of the Act to add a provision similar to that in California’s Civil Rights Council’s regulations addressing automated-decision systems that “evidence or lack of evidence concerning proactive anti-bias testing or any similar proactive effort to avoid processing personal data in violation the laws of this State, including evidence or lack of evidence concerning the quality, efficacy, recency, and scope of any such testing or effort, the results of such testing or effort, and the response to the results of such testing or effort, are relevant to any claim for a violation of the laws of this State and any available defense to such claims.”

HB 380 also adds to the risk assessment obligations in § 12-D-108 very detailed requirements about what must be considered and documented in a risk assessment for profiling in furtherance of automated decisions that produce legal of significant effects concerning a consumer, including details on “post-deployment monitoring and user safeguards provided concerning profiling, including the oversight, use, and learning processes established by the controller to address issues arising from profiling.”  To date, only California and Colorado have specific assessment content requirements, and neither require as much detail on post-deployment monitoring.

Requirements for Selling Sensitive Data

With HB 380, Delaware joins other states such as Connecticut, Maryland, Louisiana and Vermont in imposing significant conditions on the sales of sensitive data.  HB 380 provides that a controller is prohibited from selling sensitive data unless:

  • The disclosure of sensitive data is strictly necessary to provide or maintain a product or service affirmatively requested by the consumer to whom the sensitive data pertains;
  • The controller provides a clear and conspicuous notice of the sale of personal data before the sale of personal data, which must include the specific categories of sensitive data to be disclosed, the purpose of the disclosure, and identifies the third parties to which sensitive data will be disclosed;
  • The controller maintains a record of the consumer’s consent for a period of five years; and

HB 380 also clarifies that (a) sensitive data includes inferences; and (2) the exception to the definition of “sale” of disclosures of personal data to a third party for purposes of providing a product or service, when disclosed for monetary or other valuable consideration, must still meet the purpose limitations of § 12D-106(a)(2), which will limit the scope of use, especially downstream.  Both of these changes impact digital advertising.

Finally, HB 380 broadens the existing definitions of sensitive data categories, particularly regarding health, and adds new categories (neural, account numbers, government ID numbers).

Requirements for Privacy Policies

Following the enactment of HB 380, the Act will now require controllers to provide consumers a privacy notice that is “reasonably particular to the product or service offered to the consumer.” It is unclear whether this requirement, unique among state consumer privacy laws, is intended to require controllers to provide separate privacy policies for each product or service they offer. If so, that would be a material departure from the approach of most state consumer privacy laws. 

Stricter Regulation of Profiling, Including Adverse Action Notice, Appeal and Correction Requirements

The most novel aspect of HB 380 is that it provides for a set of obligations when a controller provides “reports” that are used in furtherance of a decision that produces legal or similarly significant effects concerning a Delaware “resident” (which, as noted above, includes human resources data subjects and presumably B-to-B data subjects).  These obligations are not found in any other state consumer privacy law; the closest analogues are the obligations imposed on users of consumer reports under the federal Fair Credit Reporting Act (the “FCRA”), though even the FCRA doesn’t go as far as HB 380 in the details required to be provided in notices.  HB 380 defines a “report” as any written, oral, or other communication of personal data by a controller or processor, including recommendations, summaries, or automated decisions based on personal data or profiling.  As defined, a “report” would include the outputs of artificial intelligence-driven decision-making systems.

HB 380 provides that when a controller, but notably not a processor, discloses a report to a third party for the third party’s use “in connection with” making a decision that produces legal or similarly significant effects concerning a Delaware resident (not limited to residents acting in an individual or personal context), the controller must:

  • enter into a contract with the third party that requires the third party to:
    • Provide notice to the resident of any adverse action that is based in whole or in part on any information contained in the report;
    • Provide a description of the personal data relied upon in making the adverse action;
    • Include a statement that the resident may obtain the information described below from the controller with appropriate contact information for the controller; and
    • Include a statement that the resident may request that the third party, where technically feasible, perform a human review of the adverse action concerning the resident, unless providing the opportunity for review is not in the best interest of the resident, including instances in which any delay might pose a risk to the life or safety of the resident.
  • Upon request from a resident, provide the following information within 30 days:
    • personal data maintained by the controller concerning the resident at the time of the request;
    • the source of the personal data used in profiling; and
    • identification of all third parties who obtained a report concerning the resident within the previous 24 months.
  • provide the resident an opportunity to correct any incorrect personal data.

The above requirements do not apply to a controller or third party when the report or personal data consists of a score, a model, an algorithm, or similar output that is a “consumer report” (as defined by the FCRA), or would be a consumer report if furnished to a third party, and is furnished or disclosed in compliance with the FCRA. Also, the rights provided to residents are not explicitly independently granted to residents under the Act.  Rather, the Act mandates that the controller that furnishes the reports contractually obligate the third-party recipients of the reports to provide the specified notice and rights.  At first blush, the failure of a report recipient to do so might be a breach of that contract, but would not seem to be a violation of the Act.  However, recipients of reports are characterized as third parties and new § 12D-107A(b) requires that third parties comply with the terms of contracts required by the Act.

What is not explicitly addressed is whether a controller furnishing a report to a third-party recipient is engaging in a sale of personal data that should be subject to opt-out, but when done for monetary or other valuable consideration it would seem so.

Conclusion

HB 380 transforms the Act into one of the strictest state consumer privacy laws in the nation. Businesses that are, or will in the new year become, subject to the Act should start preparing to meet the heightened requirements imposed by HB 380. As we near the 4th quarter and the obligation under the CCPA to perform an annual update of privacy notices, now is a good time to look at how the patchwork of state consumer privacy laws has set new highwater marks and various outlier obligations and limitations and determine if you need to makes changes to remain in compliance with such laws.  If you have questions or need assistance with compliance projects for HB 380 or any other new or recently amended state consumer privacy laws, please reach out to your regular Squire Patton Boggs attorney contact or the authors.

Disclaimer: While every effort has been made to ensure that the information contained in this article is accurate, neither its authors nor Squire Patton Boggs accepts responsibility for any errors or omissions. The content of this article is for general information only, and is not intended to constitute or be relied upon as legal advice.

Stay Ahead on Consumer Privacy News

Not a subscriber yet? Subscribe here to be among the first to receive timely updates on the fast-moving world of data privacy, security, and innovation—delivered straight to your inbox.

Looking for deeper insights and expert analysis? You can also subscribe here to our privacy attorneys’ marketing communications for thought leadership and rich content when you need a more comprehensive perspective.