Delaware Personal Data Privacy Act (DPDPA)

The Delaware Personal Data Privacy Act (DPDPA) was signed into law on September 11, 2023, and takes effect on January 1, 2025. Delaware became one of a growing number of US states to enact comprehensive consumer privacy legislation.

What Is the DPDPA?

The DPDPA gives Delaware residents rights over their personal data and places obligations on businesses that collect or process that data. The law is broadly modeled on other state privacy laws such as the VCDPA and CTDPA, with a notable focus on protecting children and teenagers online.

Who Does the DPDPA Apply To?

The DPDPA applies to businesses that conduct business in Delaware or target Delaware residents, and during the prior calendar year either:

• Controlled or processed the personal data of at least 35,000 consumers (excluding data processed solely for payment transactions); or
• Controlled or processed the personal data of at least 10,000 consumers and derived more than 20% of gross revenue from the sale of personal data.

Consumer Rights Under the DPDPA

Delaware residents are entitled to:

• Right to access: confirm whether a business processes their personal data and request a copy
• Right to correction: request correction of inaccurate personal data
• Right to deletion: request deletion of their personal data
• Right to data portability: obtain a portable copy of their personal data
• Right to opt out: opt out of targeted advertising, sale of personal data, and profiling for significant decisions
• Right to appeal: appeal a business's denial of a rights request

Businesses must respond to verified requests within 45 days, extendable by an additional 45 days when reasonably necessary.

Sensitive Data

Processing sensitive data requires opt-in consent. Sensitive data under the DPDPA includes racial or ethnic origin, religious beliefs, mental or physical health condition or diagnosis (including pregnancy), sex life, sexual orientation, status as transgender or nonbinary, citizenship or immigration status, genetic data, biometric data processed to uniquely identify an individual, precise geolocation data, and personal data of a known child under 13.

Delaware also imposes separate heightened protections for teenagers aged 13–17: controllers may not process their personal data for targeted advertising or sale without consent. This broader protection for minors makes Delaware's privacy regime more expansive than most other state laws.

Enforcement

The Delaware Department of Justice enforces the DPDPA. There is no private right of action. A mandatory 60-day cure period applied through December 31, 2025; as of January 1, 2026, granting an opportunity to cure is at the Attorney General's discretion. Civil penalties can reach up to $10,000 per willful violation.

How UniConsent Supports DPDPA Compliance

UniConsent provides a complete consent and preference management solution for DPDPA compliance:

• Opt-out and opt-in consent banners configurable by state
• Global Privacy Control (GPC) signal recognition
• Consumer rights request management
• Sensitive data consent workflows
• Integration with websites, mobile apps, and tag managers

Get started with UniConsent or explore our features.

Other US State Privacy Laws

• CCPA: California Consumer Privacy Act, learn more at CCPA
• CPRA: California Privacy Rights Act, learn more at CPRA
• CPA: Colorado Privacy Act, learn more at CPA
• VCDPA: Virginia Consumer Data Protection Act, learn more at VCDPA
• UCPA: Utah Consumer Privacy Act, learn more at UCPA
• CTDPA: Connecticut Data Protection Act, learn more at CTDPA
• TDPSA: Texas Data Privacy and Security Act, learn more at TDPSA

Compare different US State Privacy Laws