1. Home
  2. State breach laws
  3. Delaware

Delaware data breach notification law

What Delaware requires when personal information is exposed: how fast residents must be notified, when the Attorney General has to be told, what it costs to get it wrong, and whether affected people can sue. Governed by Del. Code Ann. tit. 6, §§ 12B-101 to 12B-104.

60 days
Notification deadline
Required
AG notification
No
Private right of action
None
Liability protection

What this means if you sell security services

Delaware's 60-day notification window means filings surface while remediation is still underway and the organization is still deciding what to change. Attorney General notice is required, and that filing is what puts the incident on the public record RiversideIQ tracks. The law itself gives individuals no right to sue, so the conversation centers on regulator penalties and remediation rather than lawsuits.

See recent Delaware breach filings →

Requirements in detail

Statute
Del. Code Ann. tit. 6, §§ 12B-101 to 12B-104
Deadline to notify residents
Without unreasonable delay and no later than 60 days after the business determines that a breach occurred. Exceptions apply when federal law requires a shorter time, when law enforcement asks for a delay, or when the business could not identify affected Delaware residents within 60 days despite reasonable diligence, in which case it must notify them as soon as practicable after identifying them.
Attorney General notification
Yes, when more than 500 Delaware residents are to be notified, and no later than the time notice is sent to residents. Since September 2, 2026, a business that cannot identify all affected residents within 60 days must also notify the Attorney General within 60 days after determining the breach, unless it has provided substitute notice within that time. The law does not require notice to consumer reporting agencies.
Penalties
The Attorney General may sue in law or equity to stop violations, obtain other relief needed to ensure compliance, and recover direct economic damages. The chapter does not set a specific dollar amount for civil penalties. When Social Security numbers are breached, the business must offer one year of free credit monitoring unless it reasonably determines the breach is unlikely to cause harm.
Private right of action
No. The breach notification law itself doesn't give individuals a right to sue; the Attorney General enforces it. People can still bring other claims after a breach, such as negligence.
Encryption exemption
Delaware's notification requirements apply to unencrypted personal information. Encrypted data generally doesn't trigger notice unless the encryption key or credentials were also compromised.
Liability protection for security programs
None. Delaware has no law limiting breach lawsuits for organizations that maintain a security program.
Recent changes
House Bill 381 (85 Del. Laws, c. 464), signed and effective September 2, 2026, added the 60-day Attorney General notice requirement for breaches where affected residents cannot be identified within 60 days, made Attorney General notice part of substitute notice, and narrowed the safe harbor for HIPAA- and Gramm-Leach-Bliley-regulated entities so that it covers only the 60-day timing rule, not the rest of the chapter.

Delaware breach notification FAQ

What is the data breach notification deadline in Delaware?

Without unreasonable delay and no later than 60 days after the business determines that a breach occurred. Exceptions apply when federal law requires a shorter time, when law enforcement asks for a delay, or when the business could not identify affected Delaware residents within 60 days despite reasonable diligence, in which case it must notify them as soon as practicable after identifying them. The governing law is Del. Code Ann. tit. 6, §§ 12B-101 to 12B-104.

Does Delaware require notifying the Attorney General of a data breach?

Yes, when more than 500 Delaware residents are to be notified, and no later than the time notice is sent to residents. Since September 2, 2026, a business that cannot identify all affected residents within 60 days must also notify the Attorney General within 60 days after determining the breach, unless it has provided substitute notice within that time. The law does not require notice to consumer reporting agencies.

What are the penalties for failing to report a data breach in Delaware?

The Attorney General may sue in law or equity to stop violations, obtain other relief needed to ensure compliance, and recover direct economic damages. The chapter does not set a specific dollar amount for civil penalties. When Social Security numbers are breached, the business must offer one year of free credit monitoring unless it reasonably determines the breach is unlikely to cause harm.

Can individuals sue over a data breach in Delaware?

No. The breach notification law itself doesn't give individuals a right to sue; the Attorney General enforces it. People can still bring other claims after a breach, such as negligence.

Does encrypted data need to be reported in Delaware?

Delaware's notification requirements apply to unencrypted personal information. Encrypted data generally doesn't trigger notice unless the encryption key or credentials were also compromised.

Does Delaware limit breach lawsuits for companies with a cybersecurity program?

No. Delaware has no law limiting breach lawsuits for organizations that maintain a security program.

Last reviewed October 5, 2026. This summary is for general information and is not legal advice. Statutes change; confirm current requirements with counsel or the Delaware Attorney General before relying on them.

Other states with a 60-day deadline

Breach notification laws by state

Compare all 51 jurisdictions on the interactive map →·US data breach statistics →