Computer Security Breaches (data security and breach notification)

Requires businesses holding Delaware residents' personal information to keep reasonable security procedures and to notify affected residents of a breach within 60 days of determining it occurred, unless an investigation shows harm is unlikely. Breaches affecting more than 500 residents must also be reported to the Attorney General, and breaches of Social Security numbers require a free year of credit monitoring. HB 381 (signed and effective Sept. 2, 2026) adds the Attorney General to substitute notice, requires Attorney General notice within 60 days where residents' involvement is identified late, and limits the HIPAA/GLBA safe harbor to the timing rule.