Skip to content
Network USA

DE ยท Breach notification statute

Delaware data breach notification law

A summary of the Delaware breach notification statute from the Privacy Rights Clearinghouse 2026 survey (laws as of 1 January 2026). This is not legal advice. Verify against the current statute and your state attorney general.

Summary

Statute citation

Del. Code tit. 6, ch. 12B (Computer Security Breaches) (amended 2017)

Last amended
2017 (as stated in the citation)
Source
PRC Data Breach Notification Laws Survey 2026

Who must notify and when

60 days Delaware requires businesses/persons to notify affected individuals without unreasonable delay

Attorney general notice

Yes Delaware requires Attorney General notification when the breach affects more than 500 Delaware

What counts as a breach

Not extracted in our PRC 2026 summary; check the statute.

What counts as personal information

Not extracted in our PRC 2026 summary; check the statute.

Coverage and remedies

Biometric dataYes
Medical informationYes
Government ID numbersNot extracted
Paper recordsNo
Private right of actionNo
Credit monitoring requiredYes

"Not extracted" means the field was not captured in our PRC 2026 summary; check the statute.

HIPAA breaches reported in Delaware

32 reports to HHS OCR affecting 5,341,160 individuals. Most common type: Hacking/IT Incident. See all HIPAA breaches in Delaware.

Five largest

HIPAA breach reports from the HHS OCR Breach Portal
Covered entityEntity typeIndividualsSubmittedType of breachStatus
Cerebral, IncBusiness Associate3,179,835Mar 1, 2023Unauthorized Access/DisclosureArchive (closed)
ConnectOnCall.com, LLCBusiness Associate914,138Dec 11, 2024Hacking/IT IncidentArchive (closed)
Bayhealth Medical CenterHealthcare Provider497,047Oct 4, 2024Hacking/IT IncidentArchive (closed)
Simon Eye ManagementHealthcare Provider144,780Sep 14, 2021Hacking/IT IncidentArchive (closed)
Brandywine Urology Consultants, PAHealthcare Provider131,825Mar 27, 2020Hacking/IT IncidentArchive (closed)

Frequently asked questions

When must Delaware businesses notify individuals of a data breach?

Our PRC 2026 extract summarises the Delaware timing rule as: "60 days Delaware requires businesses/persons to notify affected individuals without unreasonable delay". (Source: PRC 2026 survey extract.)

Does Delaware require notice to the attorney general?

The PRC 2026 extract notes: "Yes Delaware requires Attorney General notification when the breach affects more than 500 Delaware". (Source: PRC 2026 survey extract.)

Does the Delaware law cover biometric data?

Yes. The PRC 2026 survey records biometric data as covered by the Delaware breach law.

Does the Delaware law cover medical information?

Yes. The PRC 2026 survey records medical information as covered by the Delaware breach law.

Does the Delaware law cover paper records?

No. The PRC 2026 survey records the Delaware law as covering computerised data only, not paper records.

Is there a private right of action in Delaware?

No. The PRC 2026 survey does not record a private right of action under the Delaware breach law.

Is credit monitoring required in Delaware?

Yes. The PRC 2026 survey records a credit monitoring requirement in Delaware.

How does the Delaware law relate to HIPAA?

HIPAA covered entities and business associates follow the federal HIPAA Breach Notification Rule for protected health information. State breach laws can apply alongside it, and some state statutes treat HIPAA compliance as satisfying state duties. Check the Delaware statute, and see our HIPAA vs state breach notification laws guide.

Sources