Applicability of the Delaware Personal Data Privacy Act (PDPA)

Delaware has established a data protection framework to regulate the processing of personal data within the state. The primary role of this framework is fulfilled by the Delaware Personal Data Privacy Act, which governs the collection, use, and disclosure of personal data by businesses.

The Delaware Personal Data Privacy Act was adopted on September 11, 2023 and becomes effective on January 1, 2025.

Material Applicability

The Delaware Personal Data Privacy Act (PDPA) incorporates the following material applicability factors:

• Number of Data Subjects
• Revenue-Based Applicability
• Exemption for Specific Purposes of Processing
• Government and Public Agency Exemption
• Sectoral Exceptions Regulated by Other Laws
• Nonprofit Organization Exemption
• Employment and Agency Relationship Exemption
• Benefit Administration Data

Number of Data Subjects

Delaware PDPA Para.12D-103(a)(1):

"This chapter applies to persons that conduct business in the State or persons that produce products or services that are targeted to residents of the State and that during the preceding calendar year did any of the following: (1) Controlled or processed the personal data of not less than 35,000 consumers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction."

The law applies to entities processing personal data of at least 35,000 consumers, with an explicit exclusion for payment transaction data.

Revenue-Based Applicability

Delaware PDPA Para.12D-103(a)(2):

"Controlled or processed the personal data of not less than 10,000 consumers and derived more than 20 percent of their gross revenue from the sale of personal data."

This establishes a dual threshold combining consumer count and revenue percentage from data sales.

Government and Public Agency Exemption

Delaware PDPA Para.12D-103(b)(1):

"This chapter does not apply to any of the following entities: (1) Any regulatory, administrative, advisory, executive, appointive, legislative, or judicial body of the State or a political subdivision of the State, including any board, bureau, commission, agency of the State or a political subdivision of the State, but excluding any institution of higher education."

Nonprofit Organization Exemption

Delaware PDPA Para.12D-103(b)(3):

"This chapter does not apply to any of the following entities: (3) Any nonprofit organization dedicated exclusively to preventing and addressing insurance crime."

Employment and Agency Relationship Exemption

Delaware PDPA Para.12D-103(c)(11)(a):

"Data processed or maintained in any of the following ways: a. In the course of an individual applying to, employed by, or acting as an agent or independent contractor of a controller, processor, or third party, to the extent that the data is collected and used within the context of that role."

Benefit Administration Data

Delaware PDPA Para.12D-103(c)(11)(c):

"Necessary to retain to administer benefits for another individual relating to the individual who is the subject of the information under paragraph (11)a. of this subsection and used for the purposes of administering such benefits."

Territorial Applicability

Doing Business in Jurisdiction

Delaware PDPA Para.12D-103(a):

"This chapter applies to persons that conduct business in the State or persons that produce products or services that are targeted to residents of the State"

The law applies to entities either conducting business in Delaware or targeting Delaware residents with products or services.