Delaware: Delaware Amends State Data Breach Notification Law

Delaware Tightens Data Breach Notification Laws with HB 381

On September 2, Delaware Governor Matt Meyer signed House Bill 381 (HB 381), immediately amending the state’s data breach notification law to introduce stricter reporting requirements. The legislation imposes an early Attorney General (AG) notification mandate for organizations unable to identify affected Delaware residents within 60 days of discovering a breach, even if individual notices are still pending.

Key Changes Under HB 381

1. Early AG Reporting Requirement

   • Organizations must notify the Delaware AG within 60 days of determining a breach occurred if they cannot identify specific affected residents by that deadline.
   • This applies even if individual notifications are delayed due to ongoing forensic investigations or data reviews.
   • The requirement mirrors laws in Texas and Vermont, where regulatory reporting deadlines may precede individual notices.

2. Substitute Notice Expansion

   • AG notification is now mandatory as part of Delaware’s substitute notice process, ensuring regulators are informed even when direct resident notifications are impractical.

3. Narrowed Safe Harbor for Regulated Entities

   • Previously, GLBA-regulated financial institutions and HIPAA-covered entities were deemed compliant with Delaware’s breach law if they followed federal notification procedures.
   • HB 381 restricts this safe harbor to only Section 12B-102(c), which governs individual notice timing excluding broader compliance exemptions.
   • These entities must now separately assess Delaware’s AG notification rules (for breaches affecting over 500 residents) and credit monitoring requirements (for breaches involving Social Security numbers).

4. 500-Resident Threshold Remains

   • The existing rule requiring AG notice for breaches affecting more than 500 Delaware residents remains unchanged.
   • However, legislative statements suggest broader interpretations, creating uncertainty organizations are advised to monitor guidance from the Delaware AG’s office.

Impact on Organizations

• Incident response teams must update breach workflows to account for the 60-day AG reporting trigger, even if individual notices are delayed.
• Regulated entities (HIPAA/GLBA) can no longer rely on federal compliance alone to satisfy Delaware’s requirements, necessitating a dual-track evaluation of state and federal obligations.
• The law underscores the growing complexity of navigating overlapping state and sector-specific breach notification rules.

HB 381 took effect immediately, reinforcing Delaware’s stance on proactive regulatory transparency in data breach incidents.

Source: https://natlawreview.com/article/delaware-data-breach-notification-law-amendment-adds-earlier-ag-notice-narrows-glba

State of Delaware cybersecurity rating report: https://www.rankiteo.com/company/state-of-delaware

"id": "STA1789590449",
"linkid": "state-of-delaware",
"type": "Breach",
"date": "9/2026",
"severity": "50",
"impact": "2",
"explanation": "Attack limited on finance or reputation"

{'affected_entities': [{'industry': ['All'],
                        'location': 'Delaware, USA',
                        'type': 'Organizations subject to Delaware data breach '
                                'laws'},
                       {'industry': 'Financial Services',
                        'location': 'Delaware, USA',
                        'type': 'GLBA-regulated financial institutions'},
                       {'industry': 'Healthcare',
                        'location': 'Delaware, USA',
                        'type': 'HIPAA-covered entities'}],
 'data_breach': {'personally_identifiable_information': 'Social Security '
                                                        'numbers (implied for '
                                                        'credit monitoring '
                                                        'requirements)'},
 'date_publicly_disclosed': '2024-09-02',
 'description': 'On September 2, Delaware Governor Matt Meyer signed House '
                'Bill 381 (HB 381), immediately amending the state’s data '
                'breach notification law to introduce stricter reporting '
                'requirements. The legislation imposes an early Attorney '
                'General (AG) notification mandate for organizations unable to '
                'identify affected Delaware residents within 60 days of '
                'discovering a breach, even if individual notices are still '
                'pending.',
 'impact': {'legal_liabilities': 'Potential fines for non-compliance with new '
                                 'notification requirements',
            'operational_impact': 'Updated breach workflows required for '
                                  'compliance; dual-track evaluation of state '
                                  'and federal obligations for regulated '
                                  'entities'},
 'lessons_learned': 'Organizations must proactively update incident response '
                    'plans to account for overlapping state and federal breach '
                    'notification requirements, particularly for regulated '
                    'entities under HIPAA and GLBA.',
 'recommendations': ['Update breach workflows to include the 60-day AG '
                     'reporting trigger.',
                     'Regulated entities (HIPAA/GLBA) should conduct a '
                     'dual-track evaluation of state and federal obligations.',
                     'Monitor guidance from the Delaware AG’s office for '
                     'clarifications on the 500-resident threshold and other '
                     'ambiguities.'],
 'references': [{'source': 'Delaware House Bill 381 (HB 381)'}],
 'regulatory_compliance': {'regulatory_notifications': ['Early Attorney '
                                                        'General (AG) '
                                                        'notification within '
                                                        '60 days if affected '
                                                        'residents cannot be '
                                                        'identified',
                                                        'Mandatory AG '
                                                        'notification for '
                                                        'breaches affecting '
                                                        'over 500 Delaware '
                                                        'residents',
                                                        'AG notification as '
                                                        'part of substitute '
                                                        'notice process']},
 'stakeholder_advisories': 'Organizations should review and update their data '
                           'breach notification policies to comply with HB '
                           '381, particularly the early AG notification '
                           'requirement and narrowed safe harbor provisions.',
 'title': 'Delaware Tightens Data Breach Notification Laws with HB 381',
 'type': 'Regulatory Change'}