Privacy Law Library

Computer Security Breaches (data security and breach notification)

DE Breach Law

Breach notification · Data security

Requires businesses holding Delaware residents' personal information to keep reasonable security procedures and to notify affected residents of a breach within 60 days of determining it occurred, unless an investigation shows harm is unlikely. Breaches affecting more than 500 residents must also be reported to the Attorney General, and breaches of Social Security numbers require a free year of credit monitoring. HB 381 (signed and effective Sept. 2, 2026) adds the Attorney General to substitute notice, requires Attorney General notice within 60 days where residents' involvement is identified late, and limits the HIPAA/GLBA safe harbor to the timing rule.

Where
Delaware
Citation
6 Del. C. §§ 12B-100 to 12B-104 (Title 6, Chapter 12B)
Status
In force
In force since
2005-06-28
Last amended
2026-09-02
Enforced by
Delaware Attorney General (Director of Consumer Protection, Department of Justice) (12B-104(a))
People can sue
No
Penalties
The Attorney General may sue in law or equity for appropriate relief, including recovery of direct economic damages (12B-104(a)); common-law and other statutory rights are preserved (12B-104(b)).
Applies to
  • Any person conducting business in Delaware that owns, licenses, or maintains computerized personal information of Delaware residents; 'person' expressly includes government bodies (12B-101(6), 12B-102)
  • Personal information: name plus SSN, driver's license or state/federal ID, financial account or card number with access code, passport number, username or email with password or security Q&A, medical history/treatment/diagnosis or DNA profile, health insurance identifiers, authentication biometrics, or ITIN (12B-101(7))

Security duties

  • Implement and maintain reasonable procedures and practices to prevent unauthorized acquisition, use, modification, disclosure, or destruction of personal information.6 Del. C. § 12B-100

Breach duties

  • Substitute notice must also include notice of the breach to the Attorney General; where residents' involvement could not be identified within 60 days, notify the Attorney General within 60 days after determining the breach.6 Del. C. § 12B-101(5)d.4.; § 12B-102(c)(3) (as amended by HB 381) · From 2026-09-02
  • Notify affected Delaware residents without unreasonable delay and no later than 60 days after determining a breach, unless an appropriate investigation reasonably finds harm unlikely; law-enforcement delay allowed.6 Del. C. § 12B-102(a), (c)
  • Notify the Attorney General no later than notice to residents when more than 500 Delaware residents are affected.6 Del. C. § 12B-102(d) · Only if: More than 500 residents affected
  • If Social Security numbers were breached, offer one year of free credit monitoring plus enrollment and credit-freeze information, unless harm is found unlikely.6 Del. C. § 12B-102(e) · Only if: Breach includes SSNs
  • Entities that maintain but do not own the data must notify and cooperate with the owner or licensee immediately after determining a breach.6 Del. C. § 12B-102(b)
  • Substitute notice (email, website posting, statewide media and social media) is allowed if costs exceed $75,000, over 100,000 residents are affected, or contact information is lacking; breached email-account credentials may not be noticed to that same email address.6 Del. C. § 12B-101(5)d.; § 12B-102(f)

Other duties

  • Entities following their own consistent notice procedures are deemed compliant if they notify residents accordingly; after HB 381, HIPAA/GLBA-regulated entities following their regulator's breach procedures satisfy only the 60-day timing requirement of § 12B-102(c), not the whole chapter.6 Del. C. § 12B-103

Sources

Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.

Unverified: Original 2005 effective date assumed to be the approval date (June 28, 2005); the session law's effective-date clause was not confirmed. | 81 Del. Laws c. 425 (approved Sept. 4, 2018) also touched § 12B-101, apparently as a technical correction; not treated as a substantive amendment. | The Delaware Code Online text of ch. 12B fetched 2026-09-25 did not yet show the HB 381 changes; the amendments were read from the bill text, where strike-through and underline formatting was not visible, so exact final wording (and whether any floor amendment changed it) is unconfirmed.

Research reference, not legal advice.