These jurisdiction checklists are practical scoping aids for privacy, DPO, DSAR, transfer, incident, and vendor governance decisions. Confirm obligations against your facts before relying on any checklist as advice.
Delaware
Delaware Personal Data Privacy Act Compliance Checklist
Key Provisions & Questions
§ 12D-104 - Consumer Personal Data Rights
Can your organization confirm processing of a consumer's personal data and provide access to it upon request, while safeguarding trade secrets?
Does your organization provide a mechanism for consumers to request corrections to inaccuracies in their personal data?
Can your organization effectively delete a consumer's personal data upon request, and do you retain only the minimum data necessary to ensure deletion from your records without using it for other purposes?
Can your organization provide consumers with a copy of their personal data processed by automated means in a portable and readily usable format, without revealing trade secrets?
Does your organization provide clear and accessible mechanisms for consumers to opt out of targeted advertising, the sale of their personal data, and profiling for significant decisions?
Does your organization have a documented process to respond to consumer rights requests within 45 days, and to inform consumers of any necessary 45-day extensions within the initial period?
Does your organization provide requested information free of charge at least once annually, and do you have a documented policy for managing and justifying fees or denials for "manifestly unfounded, excessive, or repetitive" requests?
Is there a conspicuously available appeal process for consumers whose requests are denied, with a 60-day response timeframe, a written explanation for the decision, and clear instructions for contacting the Department of Justice upon appeal denial?
§ 12D-105 - Designation of Agent to Exercise Rights of Consumer
Does your organization recognize and comply with opt-out requests received from authorized agents, including those conveyed via universal opt-out mechanisms (like browser settings), after verifying the consumer's identity and the agent's authority?
§ 12D-106 - Duties of Controllers
Are your personal data collection practices limited to what is adequate, relevant, and reasonably necessary for the disclosed processing purposes, and do you obtain consent for any new or incompatible processing purposes?
Does your organization maintain reasonable and appropriate administrative, technical, and physical data security practices for the personal data it processes?
Do you obtain explicit consumer consent before processing sensitive data, and for known children, do you obtain parental/guardian consent and comply with relevant child privacy laws?
Is the process for revoking consent as easy as the process for giving it, and does your organization cease data processing within 15 days of receiving a revocation request?
If your organization has actual knowledge or willfully disregards that a consumer is between 13 and 17 years old, do you refrain from processing their data for targeted advertising or selling it without their consent?
Does your organization ensure that consumers are not discriminated against for exercising their privacy rights, apart from legitimate differences related to voluntary loyalty or rewards programs?
Is your privacy notice clear, accessible, and comprehensive, detailing data categories, processing purposes, consumer rights (including appeals), third-party sharing, and accurate contact information?
Do you provide secure and reliable means for consumers to submit rights requests, including a clear website link for opting out, and will you honor consumer opt-out preference signals from platforms/technologies by the specified deadline?
§ 12D-107 - Duties of Processors
As a processor, does your organization strictly adhere to controller instructions and provide necessary assistance for fulfilling consumer rights requests, ensuring data security, and managing breach notifications?
Are your contracts with controllers (as a processor) or with processors (as a controller) comprehensive and compliant with all specified requirements regarding data processing instructions, confidentiality, data handling upon termination, provision of compliance information, subcontractor engagement, and assessment cooperation?
As a processor, does your organization allow and cooperate with controller assessments, or do you arrange for independent assessments and provide the reports to controllers upon request?
§ 12D-108 - Data Protection Assessments
If your organization processes data of at least 100,000 consumers, do you conduct and document regular data protection assessments for all processing activities identified as presenting a heightened risk of harm to consumers (e.g., targeted advertising, sale of data, sensitive data processing)?
Do your data protection assessments thoroughly identify and weigh the benefits against the potential risks to consumer rights, taking into account mitigation strategies, the use of de-identified data, and consumer expectations?
Are your data protection assessments maintained in a retrievable format and ready to be provided to the Attorney General upon request, with an understanding of their confidential but enforceable nature?
Do you ensure that data protection assessments are conducted for all new or significantly modified processing activities that meet the heightened risk criteria, created or generated after the specified assessment applicability date?
§ 12D-109 - De-identified Data
Does your organization operate under the understanding that it is not required to re-identify de-identified or pseudonymous data, or maintain data in identifiable form solely for the purpose of responding to consumer requests?
If your organization processes pseudonymous data, is the information needed to identify the consumer kept separately and under effective technical and organizational controls to prevent access by the controller, thereby limiting certain consumer rights applications?
§ 12D-110 - Exclusions
Are any of your data processing activities relying on the general exclusions?
If your organization processes data for internal use (e.g., research, product improvement), is it reasonably necessary, proportionate, adequate, relevant, and limited to the specified purposes, and subject to appropriate security measures as required by the Act?
Compliance Recommendations
Consumer Personal Data Rights (§ 12D-104)
✓ If Yes:
Implement clear procedures for verifying consumer requests and providing timely access to personal data, with a documented process for handling potential trade secret conflicts.
✓ If Yes:
Establish a process for consumers to submit correction requests and for your organization to verify and implement those corrections promptly and accurately.
✓ If Yes:
Develop and implement a robust data deletion policy and technical capabilities to comply with deletion requests. Ensure that records of deletion requests are maintained as required.
✓ If Yes:
Ensure your data systems are capable of exporting personal data in common, machine-readable formats to facilitate data portability.
✓ If Yes:
Implement and conspicuously disclose effective opt-out mechanisms in your privacy notice and on your website. Ensure that processing for these purposes ceases promptly upon a valid opt-out request.
✓ If Yes:
Establish internal procedures with defined timelines for handling consumer requests, including tracking and notification for extensions.
✓ If Yes:
Ensure your policy aligns with the free-of-charge requirement for initial requests and clearly defines criteria for determining and documenting unfounded, excessive, or repetitive requests.
✓ If Yes:
Develop and clearly communicate an accessible appeal process, ensuring timely responses, comprehensive explanations for denials, and proper referral to the Department of Justice.
Designation of Agent to Exercise Rights (§ 12D-105)
✓ If Yes:
Implement systems to detect and honor universal opt-out signals, and establish robust procedures for verifying the identity of the consumer and the authority of the designated agent.
Duties of Controllers (§ 12D-106)
✓ If Yes:
Conduct data mapping and purpose limitation assessments. Review your data collection forms and processes to ensure alignment with disclosed purposes and obtain explicit, affirmative consent for any processing outside of these defined purposes.
✓ If Yes:
Implement and regularly audit a comprehensive data security program, including policies, employee training, and technical controls, commensurate with the sensitivity and volume of the data.
✓ If Yes:
Identify all sensitive data processing activities. Implement clear mechanisms for obtaining explicit, affirmative consent for sensitive data, with special attention to processes for verifying parental consent for children.
✓ If Yes:
Design consent revocation mechanisms to be user-friendly and ensure internal processes and technical systems can promptly halt data processing upon receipt of a revocation request.
✓ If Yes:
Implement reasonable efforts to ascertain the age of consumers if your processing activities involve targeted advertising or selling data of individuals who might be minors. If age is known, ensure consent is obtained.
✓ If Yes:
Review your pricing models, service offerings, and loyalty programs to ensure they do not directly or indirectly penalize consumers for exercising their rights under the Act.
✓ If Yes:
Regularly update and audit your privacy notice to ensure it meets all disclosure requirements, is easy to understand, and is readily available to consumers.
✓ If Yes:
Ensure multiple, user-friendly channels for consumer requests are available. Implement the required website link prominently. Begin preparations to recognize and comply with universal opt-out preference signals.
Duties of Processors (§ 12D-107)
✓ If Yes:
Ensure all processing activities are strictly governed by controller instructions. Develop internal processes and capabilities to effectively assist controllers with their compliance obligations under the Act.
✓ If Yes:
Review and update all controller-processor agreements to ensure they incorporate all the detailed requirements specified in the Act, covering all aspects from data processing instructions to audit rights and subcontractor management.
✓ If Yes:
Establish a clear process for responding to and facilitating assessment requests from controllers. Ensure readiness for internal or external audits, and have mechanisms to provide assessment reports as required.
Data Protection Assessments (§ 12D-108)
✓ If Yes:
If applicable, identify all high-risk processing activities and establish a regular schedule for conducting and documenting comprehensive data protection assessments. Ensure these assessments weigh benefits against potential risks and consider mitigation safeguards.
✓ If Yes:
Develop a structured methodology for data protection assessments that ensures a comprehensive risk-benefit analysis and incorporates all specified factors.
✓ If Yes:
Store all data protection assessments securely and in an organized manner, ensuring they can be promptly retrieved and provided to the Attorney General if requested during an investigation.
✓ If Yes:
Implement a process to identify and assess all relevant new processing activities that commence after the effective date of the assessment requirement.
De-identified Data (§ 12D-109)
✓ If Yes:
Document policies and procedures that reflect this exemption, ensuring that resources are not expended on re-identification efforts for the sole purpose of fulfilling certain consumer rights requests.
✓ If Yes:
Implement strong technical and organizational safeguards to ensure that pseudonymous data remains separated from identifying information, which may provide an exemption from certain consumer rights requests.
Exclusions (§ 12D-110)
✓ If Yes:
Clearly document the specific exclusions relied upon for any processing activities. Ensure that any data processed under these exemptions is done so to the extent reasonably necessary and proportionate to the specified purpose, and is subject to adequate security measures.
✓ If Yes:
Ensure internal data use practices align with the specified exemptions, are clearly documented, and are protected by appropriate administrative, technical, and physical security controls.
Need Help with Delaware Privacy Compliance?
Our expert team can provide tailored compliance solutions for your organization's specific needs under the Delaware Personal Data Privacy Act.
Checklist to implementation
Need a fact-specific view?
Data>Nuance can turn this checklist into a scoped action plan for your product, vendor stack, cross-border transfers, DSAR workflow, breach readiness, or DPO operating model.