Insurance Data Security Act
DE Insurance Data Security Act
Data security · Breach notification · Financial
Delaware's version of the NAIC model law requires insurance licensees to run a written, risk-based information security program, investigate cybersecurity events, and notify the Insurance Commissioner within 3 business days and affected consumers within 60 days. Domestic insurers must certify compliance to the Commissioner each year.
- Where
- Delaware
- Citation
- 18 Del. C. §§ 8601 to 8611 (Title 18, Chapter 86)
- Status
- In force
- In force since
- 2019-07-31
- Enforced by
- Delaware Insurance Commissioner (8607, 8610)
- People can sue
- No
- Penalties
- Violations are subject to penalties under 18 Del. C. § 329 (8610); the chapter creates no private right of action (8602(b)).
- Applies to
- Licensees under the Delaware Insurance Code (insurers, producers, and other licensees) (8603)
- Licensees with fewer than 15 employees are exempt from the information security program requirement; HIPAA-compliant licensees may certify compliance instead (8609(a))
Practices it requires
- Promptly investigate cybersecurity events and oversee third-party service providers' security.18 Del. C. §§ 8604-8605
Security duties
- Develop, implement, and maintain a comprehensive written information security program based on a risk assessment, with administrative, technical, and physical safeguards and a data retention and destruction schedule.18 Del. C. § 8604(a)-(d) · Only if: Licensee has 15 or more employees · From 2020-07-31
Breach duties
- Notify the Commissioner no later than 3 business days after determining a cybersecurity event occurred when the licensee is a Delaware-domiciled insurer or home-state producer, or the event involves 250 or more Delaware consumers and meets harm or reporting criteria.18 Del. C. § 8606(a)
- Notify each affected consumer without unreasonable delay and no later than 60 days after determining a cybersecurity event that is reasonably likely to materially harm consumers, and send the Commissioner a copy.18 Del. C. § 8606(c)
Other duties
- Domestic insurers must submit an annual written certification of compliance to the Commissioner by February 15.18 Del. C. § 8604
Sources
- Official text
- 18 Del. C. ch. 86 (Delaware Code Online)
- 82 Del. Laws c. 176 (approved July 31, 2019; effective on enactment, with 1- and 2-year phase-ins for § 8604)
Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.
Unverified: The exact subsection of § 8604 that contains the February 15 certification and the § 8604(f) third-party provider requirement (2-year phase-in to 2021-07-31) were not pinned down.
Research reference, not legal advice.