Delaware Data Breach Notification Law: 60-Day Deadline and Penalties

Delaware’s data breach notification law requires any business holding computerized personal information of Delaware residents to notify those residents of a breach without unreasonable delay and no later than 60 days after discovering it. The rule is codified at Title 6, Chapter 12B of the Delaware Code and is enforced by the Delaware Attorney General’s Consumer Protection Unit.¹

Which Businesses Are Covered

The statute reaches any person or entity that conducts business in Delaware and owns, licenses, or maintains computerized data containing personal information of Delaware residents.¹ That language is broad on purpose. It covers Delaware-incorporated companies, businesses physically operating in the state, and out-of-state companies that simply hold data belonging to Delaware residents. Size is not a factor. A three-person startup and a Fortune 500 company face the same duties.

What Data Triggers the Notification Duty

The notification obligation turns on whether a breach involves “personal information” as the statute defines it. That means a Delaware resident’s first name or first initial plus last name, combined with at least one of the following:

Social Security number
Driver’s license or government-issued ID number
Account number, credit card number, or debit card number paired with any security code, access code, or password needed to access the account
Passport number
Username or email address paired with a password or security question and answer that would unlock an online account
Medical history, treatment records, diagnoses by a healthcare professional, or a DNA profile
Health insurance policy numbers, subscriber IDs, or other unique insurer identifiers
Biometric data generated from measurements or analysis of human body characteristics for authentication purposes
Individual taxpayer identification number

Delaware’s list runs wider than older breach statutes that focused only on Social Security and financial account numbers. Online login credentials, biometric data, medical records, and taxpayer IDs are all in scope.²

Information lawfully obtained from government records or widely distributed media is excluded, even when it would otherwise fit the definition.²

When an Incident Counts as a Breach

A breach is the unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information. An employee or agent who accesses data in good faith for a legitimate business purpose has not caused a breach, provided the data is not used for an unauthorized purpose or further disclosed.²

Encryption offers a safe harbor. If the data was encrypted, notification is generally not required. The safe harbor drops away if the encryption key was also compromised, or reasonably believed to have been compromised. Encrypting a database is not enough if the attacker also obtained the keys.²

Even an unencrypted breach does not automatically trigger notification. After discovering a breach, the business must conduct an appropriate investigation and determine in good faith whether the breach is “unlikely to result in harm” to the affected individuals. A reasonable, documented conclusion of no likely harm removes the duty to notify.³ A cursory or self-serving assessment invites enforcement, and the cost of sending a notification is almost always lower than defending a decision not to send one.

The 60-Day Deadline and Its Exceptions

Once a business determines a breach has occurred and is likely to cause harm, it must notify affected Delaware residents without unreasonable delay and no later than 60 days after discovering the breach.³ The clock runs from determination of the breach, not from the date the breach itself occurred. A breach that happened in January but is discovered in June starts the 60-day window in June.

Three exceptions can adjust the timing without eliminating the duty:

If a federal law imposes a shorter notification timeline, that tighter deadline controls.
If a law enforcement agency determines notification would interfere with a criminal investigation, the business may delay. Notice must go out once law enforcement clears it.
If the business cannot identify within 60 days which specific Delaware residents were affected, it must notify them as soon as practicable after making that determination.

What the Notice Must Say

Delaware does not prescribe a mandatory template or list of required elements for breach notification letters.¹ A vague or confusing notice can still draw Attorney General scrutiny. In practice, a defensible letter describes what happened, what categories of personal information were involved, what the business is doing in response, and what steps the resident can take to protect themselves, including contact information for the business and for the major credit bureaus and instructions on fraud alerts and credit freezes.

The one strict content requirement in the statute attaches when Social Security numbers are involved, discussed below.

How to Deliver the Notice

Three delivery methods are allowed. Written notice means a physical letter to the resident’s last known address. Electronic notice is permitted if it complies with the federal E-SIGN Act. Substitute notice is available when direct notice is impractical.

Substitute notice becomes available when the cost of direct notification would exceed $75,000, the number of affected Delaware residents exceeds 100,000, or the business lacks sufficient contact information. Substitute notice requires all three of the following: email to every affected resident for whom an address is available, a conspicuous posting on the business’s website, and notification to major statewide media including newspapers, radio, television, and the business’s major social media platforms.²

A business that already maintains internal breach notification procedures as part of an existing information security program may follow those procedures instead, as long as they meet Delaware’s timing requirements.³

Free Credit Monitoring When SSNs Are Breached

If a breach involves Social Security numbers, the business must offer each affected Delaware resident free credit monitoring services for at least one year. The notice itself must contain all the information the resident needs to enroll, along with instructions for placing a credit freeze.²

The harm assessment still applies. If, after an appropriate investigation, the business reasonably determines the breach is unlikely to cause harm, credit monitoring is not required. Because Social Security numbers are the most valuable piece of data for identity thieves, arguing “no likely harm” after SSN exposure is a steep hill.

When to Notify the Attorney General

If a breach affects more than 500 Delaware residents, the business must notify the Delaware Attorney General’s office no later than the time it notifies the affected residents.³ Submissions go to the Consumer Protection Unit, which maintains a dedicated page for breach reports.¹ The 500-resident threshold is lower than many businesses assume. A mid-size retailer or healthcare provider with a moderate Delaware customer base can cross it easily.

Penalties for Noncompliance

Enforcement runs through the Delaware Attorney General under Section 12B-104. The AG may bring an action in law or equity to address violations and to recover direct economic damages caused by noncompliance.⁴

A frequently repeated claim is that the statute carries a fixed fine of $10,000 per violation. The statute text does not set a specific dollar amount. It authorizes the AG to seek “other relief that may be appropriate to ensure proper compliance” along with actual economic damages. That open-ended language gives the office significant flexibility, and exposure depends on how many individuals were affected, how severe the breach was, and how the business behaved after discovering it.

Chapter 12B does not displace other legal obligations. A business that violates the breach notification law may still face liability under other state or federal laws, and affected individuals keep any rights they have at common law or under other statutes.⁴

Safe Harbor for HIPAA and GLBA Entities

Organizations regulated under HIPAA or the Gramm-Leach-Bliley Act receive a compliance safe harbor. If the business maintains breach notification procedures established by its primary federal or state regulator and follows them when notifying affected Delaware residents, Delaware treats that as compliance with Chapter 12B.²

A hospital following HIPAA’s Breach Notification Rule does not need a separate Delaware-specific process, as long as the HIPAA-compliant notice reaches affected Delaware residents. HIPAA’s own 60-day notification deadline aligns with Delaware’s.⁵ The safe harbor is conditional. Being subject to HIPAA or GLBA is not enough on its own. The business must actually have written breach notification procedures in place and follow them.

How This Differs From Delaware’s Privacy Act

Delaware’s Personal Data Privacy Act, which took effect on January 1, 2025, is a separate statute. It creates consumer rights to access, correct, and delete personal data, opt-out rights for data sales and targeted advertising, and heightened protections for children’s data.⁶ It does not replace the breach notification law. A business that suffers a breach still has to comply with Chapter 12B regardless of its obligations under the Privacy Act.

1
Delaware Department of Justice. Data Security Breaches
2
Delaware Code Online. Delaware Code Title 6, Chapter 12B – Computer Security Breaches
3
Justia. Delaware Code Title 6 12B-102 – Disclosure of Breach of Security; Notice
4
Justia. Delaware Code Title 6 12B-104 – Violations
5
The HIPAA Journal. March 1, 2026: Small Healthcare Data Breach HIPAA Reporting Deadline
6
Delaware Department of Justice. AG Jennings Announces New Data Privacy Rights Available to Delawareans