Data Protection Impact Assessment (DPIA) (DE) - Delaware

DELAWARE DATA PROTECTION IMPACT ASSESSMENT

Controller: [________________________________]

Assessment ID and version: [________________________________]

Processing activity or product: [________________________________]

Owner and assessment date: [________________________________]

Creation or material change date: [________________________________]

1. Coverage and assessment decision

Record the facts for each threshold separately. Under 6 Del. C. § 12D-103(a), the general chapter coverage test uses a preceding-calendar-year 35,000-consumer route or a 10,000-consumer route combined with more than 20% of gross revenue from personal-data sales, subject to the section's nexus, exclusions and exemptions. The current 2026 assessment duty in § 12D-108(a) has a separate threshold: a controller must control or process data of at least 100,000 consumers, excluding payment-only data, and assess its processing activities that present a heightened risk of harm. Do not infer an assessment duty merely from the general chapter threshold.

Heightened-risk activity under § 12D-108(a):

☐ Targeted advertising: [________________________________]

☐ Sale of personal data: [________________________________]

☐ Profiling with reasonably foreseeable unfair or deceptive treatment, unlawful disparate impact, financial, physical or reputational injury, offensive intrusion, or other substantial injury: [________________________________]

☐ Processing sensitive data: [________________________________]

☐ No listed activity; basis for conclusion: [________________________________]

Assessment status: [required under current § 12D-108 / voluntarily prepared / further review needed]

Future-law review: The official Code displays a separate version of § 12D-108 effective January 1, 2027. Recheck that version before relying on this assessment for later processing: [review owner and date].

2. Processing and data flow

Consumers affected, approximate number and relationship to controller: [________________________________]

Sensitive data and access groups: [________________________________]

Processors, subprocessors and onward recipients: [________________________________]

Data-flow diagram or system inventory reference: [________________________________]

3. Benefits, necessity and expectations

Section 12D-108(b) calls for a balance of direct and indirect benefits against potential risks to consumer rights after safeguards. It also directs consideration of de-identified data, reasonable consumer expectations, processing context and the controller-consumer relationship.

4. Risks and safeguards

For each reasonably foreseeable risk to consumer rights, identify affected people, evidence, likelihood, impact, safeguard and residual risk. Address each selected heightened-risk activity.

Access, authentication and encryption design: [________________________________]

Data minimization, retention and deletion controls: [________________________________]

Consumer notice, choice and rights handling for this activity: [________________________________]

Vendor instructions, oversight and contract status: [________________________________]

Testing, monitoring, incident escalation and unresolved findings: [________________________________]

5. Legal and incident-response register

Enter any additional applicable Delaware, federal or other-jurisdiction rule from its current official source. This assessment records the decision; a separate incident review determines any breach-notice duties from the actual facts.

6. Balance, mitigation and decision

Benefits after considering alternatives: [________________________________]

Potential risks before safeguards: [________________________________]

How safeguards reduce each risk: [________________________________]

Reasoned balance of benefits and residual consumer risks: [________________________________]

Mitigation tasks, owners and due dates: [________________________________]

Decision and conditions: [approve / revise / do not proceed; details: __________]

Next review date and material-change triggers: [________________________________]

7. Review and approval

Privacy lead — name, decision, date: [________________________________]

Security lead — name, decision, date: [________________________________]

Legal reviewer — name, decision, date: [________________________________]

Business owner — name, decision, date: [________________________________]

Final approver — name, title, decision, date: [________________________________]

Supporting records and approved version location: [________________________________]

Sources and References

• Delaware Code, Title 6, Chapter 12D, §§ 12D-103 and 12D-108 (2026 effective text; the Code also displays prospective 2027 text).