Delaware Personal Data Privacy Act (DPDPA )
The DPDPA requires companies to maintain "reasonable administrative, technical, and physical data security practices to protect the confidentiality, integrity, and accessibility of personal data appropriate to the volume and nature of the personal data at issue."
Is Complying with DPDPA Mandatory?
The DPDPA applies to persons who conduct business in Delaware or produce products or services targeted to Delaware residents and who, during the preceding calendar year, either: (1) controlled or processed the personal data of at least 35,000 Delaware residents (excluding personal data controlled or processed solely for the purpose of completing a payment transaction); or (2) controlled or processed the personal data at least 10,000 Delaware residents and derived more than 20 percent of their gross revenue from the sale of personal data.
The 35,000-consumer threshold is the lowest among states with enacted consumer data privacy laws (Montana comes in second with a 50,000-consumer threshold), likely to account for Delaware's smaller population.
What are the penalties for not complying with DPDPA?
Violations of the DPDPA may be enforced solely by the Delaware Department of Justice (the state's office of attorney general). A violation of the DPDPA is a per se violation of Delaware's Consumer Fraud Act.