Delaware Tightens Data Breach Rules: Faster AG Notice, Narrower Safe Harbors
Delaware mandates 30-day AG notice and limits GLBA/HIPAA safe harbors for data breaches.
Why it matters: Faster reporting deadlines increase regulatory scrutiny and could heighten breach exposure for firms in sensitive sectors. Legal teams in finance and healthcare must adapt incident response and compliance strategies accordingly.
- Delaware’s House Bill 381 was signed into law on September 2, 2026, by Governor Matt Meyer.
- Businesses must notify the Delaware Attorney General within 30 days of discovering breaches affecting over 500 residents.
- Safe harbor protections for GLBA and HIPAA compliance are narrowed; affected individuals and the Attorney General must still be notified.
- Previously, Delaware did not impose a strict deadline for Attorney General notification on such breaches.
Delaware has amended its data breach notification law to accelerate reporting and tighten exemptions for federally regulated entities. On September 2, 2026, Governor Matt Meyer signed House Bill 381, advancing the notification timeline for breaches affecting over 500 residents.
Under the new law, businesses must alert the Delaware Attorney General no later than 30 days after discovering a breach. Previously, the statute mandated notification for breaches of that scale but without a fixed deadline.
The amendment also narrows safe harbor provisions for companies compliant with the Gramm-Leach-Bliley Act (GLBA) and the Health Insurance Portability and Accountability Act (HIPAA). Even if businesses meet federal data security requirements, they must still notify affected Delaware residents and the Attorney General about breaches.
Governor Meyer emphasized the importance of the legislative update, stating, “These amendments ensure that Delaware remains at the forefront of data protection, holding businesses accountable and safeguarding our residents' personal information.”
For legal counsel managing incident response in financial services and healthcare sectors, these changes demand a reassessment of reporting protocols and breach disclosure policies to align with stricter state-level requirements.
By the numbers:
- 30 days — deadline to notify Delaware Attorney General after a breach affecting over 500 residents
- 500 residents — breach threshold triggering mandatory notification to the AG