Quick Hits
- Governor Matt Meyer signed amendments to the Delaware Personal Data Privacy Act on September 2, 2026, that further limit profiling and automated decision-making based on the personal data of job applicants, employees, and independent contractors.
- Violations of the law can result in civil penalties up to $10,000 per violation.
- The amendments will take effect on January 1, 2027.
The Delaware Personal Data Privacy Act (DPDPA) took effect on January 1, 2025. The law currently regulates people who conduct business in Delaware (or people producing products or services targeted to Delaware residents) that process personal data of at least 35,000 Delaware consumers, or process personal data of at least 10,000 Delaware consumers and derive at least 20 percent of their annual revenue by selling personal data. Beginning on January 1, 2027, those numbers will drop to 10,000 for the first category and 5,000 for the second category.
Similar to other comprehensive privacy laws across the country, personal data under the DPDPA includes any information that is “linked or reasonably linkable to an identified or identifiable individual,” but does not include deidentified data or publicly available information, and relies on the twin concepts of “controllers” and “processors.” It also requires a privacy notice.
The DPDPA does not currently apply to data collected by employers for hiring and employment purposes (although that will change somewhat starting on January 1, 2027), medical data covered by the Health Insurance Portability and Accountability Act (HIPAA), and clinical trial data, as well as a number of other exclusions for certain types of entities (e.g., those engaged in insurance, banking, and securities). Violations of DPDPA may result in civil penalties up to $10,000 per violation.
The DPDPA permits Delaware consumers to access, correct, and delete their personal data and opt out of targeted advertising, data sales, and certain profiling. The law requires a consumer’s consent before processing sensitive data, including a person’s race, national or ethnic origin, religion, sexual orientation, immigration status, genetic and biometric data, financial credentials, and precise geolocation data.
The amendments expand the definition of sensitive data to encompass mental or physical health treatment or diagnosis, neural data, and certain financial data that would allow access to a consumer’s financial account, as well as inferences made based on personal data that would reveal the same. The amendment prohibits the sale of sensitive data unless:
- the disclosure of sensitive data is “strictly necessary” to provide or maintain a product or service affirmatively requested by the consumer;
- the controller provides a “clear and conspicuous” notice of the sale of personal data before the sale;
- the controller maintains a record of the consumer’s consent for five years; and
- the record of consent is provided with any data protection assessment requested by the Delaware attorney general.
The amendments introduce a requirement for controllers to conduct impact assessments if they process the personal data of 50,000 or more Delaware consumers for processing activities that may present a “heightened risk of harm” to a consumer, which includes targeted advertising, the sale of personal data, the profiling of a consumer (where it presents a risk of unlawful discrimination, financial injury, or intrusion into privacy affairs), or the processing of sensitive data. The same applies where a processor may be profiling consumers in furtherance of automated decisions that produce legal or similarly significant effects on a consumer. Profiling includes any form of automated processing performed on personal data to evaluate, analyze, or predict factors related to demographic characteristics, personal preferences, interests, reliability, behavior, location, or movements.
Legal or similarly significant decisions are those that would result in the provision or denial of employment opportunities, insurance, healthcare services, financial services, housing, education enrollment, criminal justice, or access to essential goods or services.
An impact assessment must include the intended uses of the profiling, reasonably foreseeable risks of harm, categories of personal data processed, performance metrics and known limitations, transparency measures, and post-deployment monitoring and safeguards.
Hiring and Employment Decisions
One important aspect of the new amendments is that, while the law continues to exclude employees from the definition of “consumers,” the amendments introduce a separate category known as “residents,” who do not share all of the same rights as consumers, but which may provide a new, separate basis for regulating employers indirectly via their status as a third party that acquires personal data from a controller.
While employment-related personal data is still generally excluded, now subject to the DPDPA will be personal data processed in connection with profiling and reports, meaning written, oral, or other communication of personal data by a controller or processor, including recommendations, summaries, and automated decisions based on personal data or profiling.
The DPDPA may come into play where an employer orders a report from a vendor (acting as a controller), and such report is not a consumer report or would not be if disclosed to a third party, it is not furnished or disclosed in compliance with the Fair Credit Reporting Act (FCRA), and it is used or relied upon in connection with a decision resulting in the provision or denial of employment opportunities for a Delaware resident.
It seems that Delaware was seeking to address that gray area where employers have asked vendors (often incorporating automated decision-making tools) to source, screen, or rank job candidates, partly based on outside data assembled by the vendor, and ultimately used the information to make a decision on a candidate before ever reaching the official background check stage regulated by the FCRA.
Under the amendments, the controller is responsible for imposing contractual obligations on third parties receiving the report, including notifying the resident of any adverse action based on the report, a description of the personal data relied upon in making the adverse action, the resident’s right to obtain information from the controller, and the resident’s right to have the controller perform a human review of the adverse action. In addition, the controller must, upon request from the resident, provide within thirty days the personal data maintained about the resident, the source of the personal data used in profiling, identify all third parties that obtained a report concerning the resident within the previous twenty-four months, and the opportunity to correct any incorrect personal data.
Controllers also may not process personal data or engage in profiling in violation of state or federal laws prohibiting unlawful discrimination. Delaware considers anti-bias testing for AI tools (or lack thereof) to be relevant to any claims for such violations.
Next Steps
Delaware’s privacy law amendments arrived as an increasing number of states are adopting and refining their comprehensive data privacy laws. Delaware employers may still process the personal data of job applicants and employees, but may want to review how they use AI tools in recruiting, hiring, performance reviews, discipline, and termination decisions, and take adequate steps to ensure compliance with the new amendments to the privacy law before January 1, 2027.
Ogletree Deakins’ Artificial Intelligence and Innovation Practice Group and Cybersecurity and Privacy Practice Group will continue to monitor developments and will post updates on the Artificial Intelligence and Innovation, Cybersecurity and Privacy, and Delaware blogs as additional information becomes available.
Harris S. Freier is a shareholder in Ogletree Deakins’ Morristown office.
Elizabeth R. Lash is senior counsel in Ogletree Deakins’ New York City office.
This article was co-authored by Leah J. Shepherd, who is a writer in Ogletree Deakins’ Washington, D.C., office.
Follow and Subscribe
LinkedIn | Instagram | Webinars | Podcasts
