← All jurisdictions
DE · data breach notification
medDelaware
Del. Code tit. 6 §12B-101 et seq.
Individual deadline
60 days
Trigger standard
Risk of harm
AG / regulator
Required
| Notice to individuals | 60 calendar days from discovery |
| Risk-of-harm standard | notice unless investigation reveals misuse of information is unlikely |
| Encryption safe harbor | Yes, encrypted data (key not compromised) generally exempt. |
| Regulator notice | Delaware Attorney General, required above 500 residents; not later than the time notice is provided to residents Written notice (mail/email) to AG |
| Credit reporting agencies | No CRA-notice requirement. |
| Credit monitoring | One year of credit monitoring required when SSN exposed |
| Substitute notice | Typically available above $250,000 cost / 500,000 affected (verify). |
| Private right of action | No, enforcement by the state. |
| Notable PI definitions | Includes biometric, credentials, medical, health insurance, passport, tax id. |
Rule last verified July 10, 2026 · confidence med. This is a reference summary, not legal advice; verify against the current statute. How we compile this →
Is a Delaware breach part of a multi-state incident?
See every jurisdiction at once, with letters and filing packets generated.
Run the calculator →