The Delaware rule in full 60 days
Del. Code Ann. tit. 6, §§ 12B-100 to 12B-104
- Notify residents
- No later than 60 days after determining the breach, and without unreasonable delay, unless federal law requires less time or law enforcement asks for a delay. Residents not identified within 60 days must be notified as soon as practicable once identified.
- Notify the state
- Notify the Attorney General no later than when residents are notified, if the number of Delaware residents to be notified exceeds 500. If affected residents cannot be identified within 60 days, notify the AG within 60 days of determining the breach, unless substitute notice is given in that time.
- Credit bureaus
- Not required.
- No-harm exception
- No notice is needed if, after an appropriate investigation, the business reasonably determines the breach is unlikely to result in harm to the individuals. No documentation or AG notice is required.
- Encryption
- Acquiring encrypted data is not a breach unless the acquisition includes, or is reasonably believed to include, the encryption key and the owner reasonably believes the key could make the data readable.
- Data covered beyond the basic set
- Passport number, online account credentials, medical information, genetic data, health insurance information, biometric data, taxpayer ID.
- Enforcement
- The Attorney General may sue in law or equity to address violations and recover direct economic damages. The statute sets no separate penalty amount and preserves any other rights a person has by law.
- Recent change
- HB 381 (85 Del. Laws c. 464), signed September 2, 2026 and effective on signing, requires Attorney General notice within 60 days when affected residents cannot be identified in that time. It also limits the HIPAA and Gramm-Leach-Bliley safe harbor to the timing rules in § 12B-102(c).
- Also know
- If Social Security numbers are breached, the business must offer one year of free credit monitoring unless it determines harm is unlikely. Covers computerized data. Vendors must notify the owner immediately after determining a breach. HIPAA and GLBA businesses following their own breach procedures are deemed compliant only with the § 12B-102(c) timing rules, including the 60 day AG notice, not with the more than 500 AG notice or credit monitoring.
Law: Del. Code Ann. tit. 6, §§ 12B-100 to 12B-104. Read from the statute and checked by a second reviewer on October 13, 2026. Compare all states.
Neighboring states: Maryland, Pennsylvania, New Jersey. A breach that reaches their residents brings in their rules too.
Dealing with a breach right now? Two short steps. A security provider follows up by email within one business day.
Get a quote for my businessThe Delaware data breach notification law: deadline and data
Chapter 12B of Title 6 counts from the day a business determines there was a breach, and day 60 is the outer limit for residents 1; the letters still cannot be unreasonably delayed before then 1. A tighter federal deadline prevails, and police may request a hold. Anyone you only identify after day 60 is notified as soon as practicable after that 1.
Computerized data is covered, and the definition is broad: passport and taxpayer ID numbers, usernames or email addresses paired with passwords, and medical, health insurance, genetic and biometric data all sit beside the familiar identifiers 1.
A breach involving Social Security numbers means a year of free credit monitoring must be offered, unless the business determines harm is unlikely 1.
The 2026 change: HB 381
HB 381, signed September 2, 2026 and reported as effective on signing, rewrote two pieces 14:
- Unidentified residents. When you cannot work out which Delaware residents were affected within 60 days of determining the breach, the Attorney General must be told within those 60 days, unless substitute notice has gone out by then.
- A thinner HIPAA and GLBA safe harbor. Following HIPAA or Gramm-Leach-Bliley procedures now satisfies only Delaware's timing rules, the new 60-day notice included. The Attorney General filing above 500 residents and the credit monitoring offer still apply.
The amended text is already in the official code. A medical office that leaned on HIPAA alone needs to revise its plan; read it together with our HIPAA breach letter summary.
Want a second opinion on your setup? Send a short request and one provider follows up by email within one business day. How it works.
Get a quote for my businessAttorney General notice, exceptions and enforcement
Past 500 Delaware residents to notify, the Attorney General's notice goes no later than theirs 1.
An appropriate investigation ending in a reasonable conclusion that harm is unlikely removes the duty 1. No memo is required by law; write one anyway and attach the forensic report.
Taking encrypted files is no breach unless the key went too (or probably did) and the owner reasonably believes it could make the data readable 1. A vendor holding your records must tell you immediately after it determines there was a breach.
Enforcement is an Attorney General suit for violations and direct economic damages, with no separate penalty set and other legal rights preserved 1. A direct private suit under the chapter is uncertain.
What to do first after a Delaware breach
With intruders still inside, a Delaware business holding a cyber policy rings the claims number first, logs the attack on the FBI's ic3.gov site, and keeps every drive intact until it has been imaged 253. Ask whether the carrier insists on its panel lawyers before you call your own; policy conditions small firms run into explains the usual terms.
Containment falls to your IT contractor or an outside specialist, and our response playbook shows who does what. Start the list of affected people on day one and sort it by state: the new unidentified-residents rule punishes slow lists, and Maryland and Pennsylvania residents carry their own laws. Every state's deadline sits in one comparison table.
We updated this summary for HB 381 and rechecked chapter 12B on October 13, 2026. Because the amendment is new, get legal advice from Delaware counsel on how it touches your business.
Common questions
When is notice due under the Delaware data breach notification law?
Within 60 days of determining the breach, without unreasonable delay 1. A shorter federal clock or a police hold changes that.
Do you have to notify the Delaware Attorney General?
Above 500 residents, no later than the residents 1. HB 381 adds a second trigger: affected residents you cannot identify within 60 days, unless substitute notice went out.
Do HIPAA-covered businesses still have to notify the Delaware Attorney General?
Yes. HIPAA or GLBA compliance now covers only the timing rules 1; the over-500 filing and the monitoring offer remain.
Does Delaware require credit monitoring after a breach?
For breaches involving Social Security numbers, one free year must be offered unless harm is judged unlikely 1.
Does Delaware's law apply to encrypted data?
Only if the key was, or probably was, taken too and could make the files readable 1.
Sources
- Delaware Code Online, Del. Code Ann. tit. 6, §§ 12B-100 to 12B-104, 2026.
- Federal Trade Commission, Data Breach Response: A Guide for Business, 2025-06-20.
- FBI, Ransomware, 2026-04-08.
- Polsinelli PC, Delaware Data Breach Law Amendment: AG Notice, GLBA/HIPAA Safe Harbor, 2026-09-16.
- Federal Trade Commission, Cyber Insurance, 2021-11-09.
Updated October 13, 2026.