Data Breach Notice to Residents and State Authorities in Delaware
At a glance
| Covered entity and service provider | DE-doing-business owner/licensee of computerized PI tells residents; nonowner holder tells and cooperates with owner/licensee immediately after breach determination (§ 12B-102(a)-(b)) |
|---|---|
| Breach and covered information | Unauthorized acquisition of computerized PI compromising security/confidentiality/integrity; encrypted data counts if key acquired/likely acquired and owner reasonably believes readable; listed identifiers include passport, online credentials, medical, biometric, tax ID (§ 12B-101(1),(7)) |
| Risk screen or notice exception | After appropriate investigation, owner may withhold notice on reasonable finding harm unlikely; good-faith employee acquisition excluded absent unauthorized use/disclosure (§§ 12B-101(1)a., 12B-102(a)) |
| Individuals who receive notice | DE resident whose PI was or reasonably believed breached; email-account credential breach has special delivery restriction; nonowner holder tells owner/licensee (§ 12B-102(a),(b),(f)) |
| Individual notice deadline and clock | Without unreasonable delay, not later than 60 days after breach determination; shorter federal deadline, law-enforcement delay, and reasonable-diligence late identification routes stated (§ 12B-102(c)) |
| Regulator threshold and deadline | >500 DE residents to notify: AG by resident-notice time. If certain residents unidentified within 60 days despite diligence: AG within 60 days unless qualifying substitute notice given by then (§ 12B-102(c)(3),(d)) |
| Consumer-reporting-agency notice | No general bureau notice in chapter 12B; SSN breach instead requires one year of free credit monitoring and freeze information unless harm reasonably unlikely (§ 12B-102(e)) |
| Individual delivery and content | Writing, phone, qualifying E-SIGN/primary-channel email, or eligible substitute; email-account login breach cannot be noticed to compromised address, may use usual account login screen. SSN route adds monitoring/freeze information (§§ 12B-101(5), 12B-102(e)-(f)) |
| Substitute notice conditions and channels | Cost >$75,000, >100,000 DE residents, or insufficient contact; all available email, website posting if maintained, statewide media plus major social platforms, AND AG notice (§ 12B-101(5)d.) |
| Delays and alternate compliance | Law-enforcement criminal-investigation request pauses notice until clearance; shorter federal clock controls. Own policy route keeps chapter timing; regulator rules route deemed compliant with § 12B-102(c) when followed (§§ 12B-102(c)(1)-(2), 12B-103) |
Requirements one by one
Breach determination, roles, and risk screen
Delaware's § 12B-101 defines a breach as unauthorized acquisition of computerized personal information that compromises security, confidentiality, or integrity. Encrypted data comes back within the rule if the key was or likely was acquired and the owner reasonably believes it could make the information readable. The personal-information list includes passport numbers, medical and genetic information, biometrics, tax IDs, and online account credentials.
Under § 12B-102(a), an owner or licensee doing business in Delaware tells residents whose information was or likely was breached after determining the breach. It may forgo notice after an appropriate investigation reasonably determines harm is unlikely. A nonowner holder instead tells and cooperates with the owner or licensee immediately after its determination (§ 12B-102(b)).
Resident and attorney-general clocks
Resident notice is due without unreasonable delay and no later than 60 days after determination. Section 12B-101(2) defines determination as having enough evidence to conclude a breach occurred. A shorter federal deadline controls, and a qualifying law-enforcement request can delay notice until clearance (§ 12B-102(c)(1)-(2)).
If reasonable diligence still cannot identify some affected Delaware residents within those 60 days, § 12B-102(c)(3) directs notice to those residents as soon as practicable after identification. It also requires notice to the Attorney General within 60 days of breach determination unless qualifying substitute notice was given by then. Separately, more than 500 Delaware residents to be notified triggers Attorney General notice no later than resident notice (§ 12B-102(d)).
Delivery and account-specific steps
Direct delivery can be written, telephonic, or electronic if it meets the federal E-SIGN rule or electronic communication is the person's primary channel (§ 12B-101(5)). If a breach involves login credentials for an email account the person furnished, it cannot use that same email address for notice. Section 12B-102(f) allows another lawful method or clear online notice when the resident connects from a customary location.
Substitute notice is available when direct notice will cost over $75,000, more than 100,000 Delaware residents are to be notified, or contact information is insufficient. It requires all applicable email, website posting, statewide media and major social-media platform publication, and Attorney General notice (§ 12B-101(5)d.).
If breached information includes a Social Security number, § 12B-102(e) also calls for one year of free credit monitoring and information on enrollment and credit freezes, unless the appropriate investigation reasonably finds harm unlikely.
What trips people up
The substitute route reports to the Attorney General itself. Section 12B-101(5)d.4. requires that report as one of the channels even when § 12B-102(d)'s 500-person trigger is not met.
Alternate procedures do not erase timing. An entity's own information-security-policy route must retain chapter timing; a regulated entity following its regulator's procedures is deemed compliant specifically with § 12B-102(c), as § 12B-103 states.
Common questions
Does a service provider start its clock on discovery?
Section 12B-102(b) measures the nonowner holder's immediate owner notice from determination of the breach, not mere discovery.
Is a credit-bureau notice required for every large breach?
Chapter 12B states no general reporting-agency notice. Section 12B-102(e) instead addresses free monitoring for residents whose Social Security numbers were breached, subject to its harm finding.
What if only some affected residents are identified late?
Section 12B-102(c)(3) gives the late-identified residents an as-soon-as-practicable notice route and specifies the separate 60-day Attorney General or substitute-notice condition.
Statutes and sources
- 6 Del. C. § 12B-101 — definitions and notice methods.
- 6 Del. C. § 12B-102 — resident, holder, and attorney-general notice.
- 6 Del. C. § 12B-103 — alternate procedure routes.
Current official Delaware Code and HB 381's official effective-date record checked October 14, 2026.
Source links
Every statute quoted above, linked, with the date we checked it.
What does Delaware law mean for your facts?
You just read the general rule. Ask your own question and see which parts of current Delaware law apply to your situation, with citations you can check.
Try Ezel Pro free for 7 days. Cancel anytime before the trial ends and you pay nothing.
- Starts from the statutes this survey is built on
- Cites every source it relies on, so you can verify it
- Chat, drafting and research in one workspace