Delaware data breach notification law

Requires reasonable procedures and practices to protect personal information (§ 12B-100), plus notice to affected residents and — where more than 500 Delaware residents must be notified — to the Attorney General (§ 12B-102(d)). HB 381 (signed and effective Sep 2, 2026) clarified when that AG notice is owed and added a hard outer deadline: notice without unreasonable delay and no later than 60 days after determination of the breach. Applies regardless of company size whenever you hold covered personal information about a resident of this state.