Delaware Passes Delaware Personal Data Privacy Act (DPDPA)

Delaware is now the 13th state to enact a comprehensive data privacy law.  The state passed this law on September 11, 2023, and it is set to take effect on January 1, 2025.  A blog post from Davis Wright Tremaine LLP details 10 notable provisions as well as consumer rights and exemptions detailed in the act.

The other states with similar data privacy laws are:

California, Colorado, Connecticut, Florida, Indiana, Iowa, Montana, Oregon, Tennessee, Texas, Utah, and Virginia.  

As has been covered in the previous Today’s General Counsel article, The Current State of U.S. Data Privacy Laws, nothing is being done on a federal level to protect consumer data so it is up to the state governments to protect their citizens. 

This new privacy law, the Delaware Personal Data Privacy Act (DPDPA), protects the personal information of Delaware citizens such as allowing them to opt out of having their personal data stored and sold to third parties.  This law impacts companies that serve and take the personal data of at least 35,000 Delaware consumers, a relatively small number compared to the other states’ threshold due to Delaware being a smaller state.

DPDPA requires that these companies maintain a certain level of information security so as to safeguard the data of their customers.  Additionally, the data of children between the ages of 13 to 18 is not allowed to be processed.  The DPDPA also differs from other state’s privacy laws as it allows consumers to request to know specifically which type of third-party organization their data is being sold to.