BILLPEEK · plain maps of new state rules

Delaware's privacy law covers more businesses in 2027

For businesses with Delaware customers. On Jan 1, 2027, the line drops from 35,000 to 10,000 people.

Answer a few questions. Free, no email.
See if your 2026 numbers may put you in.
Get a list of what to ask a lawyer.

What changes on January 1, 2027

Today (until Dec 31, 2026)35,000Delaware residents' data

From Jan 1, 202710,000Delaware residents' data

The "sells data" line drops from 10,000 to 5,000 residents (for businesses earning more than 20% of gross revenue from selling personal data).
A new third line, with no number at all: "third parties who acquire personal data from a controller."
The law counts the preceding calendar year, so your 2026 numbers matter for 2027.
You may have seen 15,000 in a bill summary. That is not the number in the law as written in the Delaware Code.

Source: Delaware Code Title 6, Chapter 12D, § 12D-103 (version effective Jan. 1, 2027), delcode.delaware.gov. Last checked: October 23, 2026.

The check (no name or email)

1. Do you do business in Delaware, or offer products or services aimed at people who live in Delaware? Yes No Not sure

2. Could your organization be one of these types?

The law lists these types separately (§ 12D-103(b)). Each one has extra conditions, so if you pick one, your result will say a lawyer needs to confirm it. Most nonprofits are not on this list.

None of these Not sure, or I haven't checked the conditions A state or local government body (public colleges are not included) A bank, credit union or savings association (or its affiliate) An insurer, health carrier or related entity principally in financial activities A broker-dealer, investment adviser or securities agent regulated by Delaware or the SEC, or a national securities / futures association A nonprofit dedicated only to preventing insurance crime

3A. In all of 2026, about how many different Delaware residents did you hold or use personal data about? Leave out people whose data you used only to take a payment.

Count people, not orders or list rows. Think customer lists, email lists, loyalty programs and online accounts. People you dealt with only in their work role or as employees don't count (§ 12D-102(9)). If you're not sure what to leave out, choose "I don't know".

Fewer than 5,000 5,000 – 9,999 10,000 – 34,999 35,000 or more I don't know

3B. Same count again, but this time keep in the people whose data you used only to take a payment. About how many is that for all of 2026?

This count is for the law's "selling data" line (§ 12D-103(a)(2)), which doesn't say to leave out payment-only data. It should be the same as 3A or higher. The other people-who-don't-count rules still apply; if you're unsure, choose "Not sure".

Fewer than 5,000 5,000 – 9,999 10,000 – 34,999 35,000 or more Not sure

4. In 2026, did more than 20% of your total (gross) revenue come from selling personal data?

Exactly 20% doesn't count; it has to be more. Some sharing isn't a "sale" under the law, for example giving data to a company that processes it for you, or to a company in your own group. There are other exceptions too (§ 12D-102(32)). If you haven't checked these, choose "Not sure".

Yes, more than 20% Exactly 20% No Not sure

5. In 2026, did you get personal data from another business that collected it and decides how it's used? (The law calls that business a "controller". Examples: buying or renting a list, or receiving shared customer data.) Yes No Not sure

5A. If you answered yes to 5: in what role did you get that data?

The law's new third line covers "third parties" that get data from a controller (§ 12D-102(37)). Getting data only as a service provider working for that business, or only within your own group of companies (shared brand or control, § 12D-102(2)), may not count. There is also an exception tied to the listed organization types. Your answer should cover all the data you got in 2026. If it was a mix, or you haven't checked, choose "Not sure".

As a third party: at least once, we got data as a "third party" under the law's definition, and we've checked the exceptions Only as a service provider (a "processor") working for that business, using the data only for that work, and we've checked the exceptions Only from a company in our own group (shared brand or common control), no other way, and we've checked the exceptions Not sure, it was a mix, or we haven't checked

Year check: are your answers above for the whole of 2026 (January to December)?

The 2027 rules look at your numbers for all of 2026. 2026 isn't over yet, so if your answers cover only part of the year or are an estimate, choose "No" and the result will say it can't decide yet.

Yes, for all of 2026 No, part of the year or an estimate Not sure

Optional: where are most of your customers?

Helps us learn who this page is useful for.

Mostly Delaware and nearby states Spread across the US Other / prefer not to say

Please answer questions 1 to 5, both counts (3A and 3B), and the year check.

When you press the button, your multiple-choice answers and the result type are sent anonymously (no name, no email, nothing typed) so we can count how often the check is used. These are counts of checks, not of people. No cookies, no ad trackers.

Your result

Statutory branch	Until Dec 31, 2026 (reference only)	From Jan 1, 2027	Your answer

This is not a ruling on your business. It only compares your answers with the law's text. Some data is exempt (for example HIPAA health information, FERPA student records, FCRA and Gramm-Leach-Bliley data; see § 12D-103(c)). Confirm with a lawyer before you rely on it.

Want the full checklist? Pre-order free.

The Delaware 2027 Privacy Checklist ($39) is a plain list of what the law says, quoted with section numbers: the three coverage lines, the exemptions, consumer rights, privacy notice contents, opt-outs, sensitive data consent, and the dates. It is a reading aid, not advice on what your business should do.

No charge today. Pre-ordering only asks for an email address.
If enough people pre-order, we finish it and email you a payment link. You can say no then.
If we don't build it, we tell you, and delete your email.

Pre-order — $0 today

Prefer just the free one-page summary? Use the same form and choose "free summary only".

Sources

Delaware Code, Title 6, Chapter 12D (Delaware Personal Data Privacy Act), §§ 12D-102, 12D-103 (versions effective until and from Jan. 1, 2027), § 12D-111: delcode.delaware.gov/title6/c012d (https://delcode.delaware.gov/title6/c012d/index.html)
State of Delaware news release, Sept. 2, 2026 (HB 380 and HB 381 signed; effective Jan. 1, 2027): news.delaware.gov (https://news.delaware.gov/2026/09/02/governor-meyer-signed-historic-data-privacy-legislation-protecting-delaware-residents-and-businesses/)
House Bill 380, Delaware General Assembly: legis.delaware.gov/BillDetail/143105 (https://legis.delaware.gov/BillDetail/143105)

Enforcement: the Delaware Department of Justice enforces the law; there is no private right to sue under it (§ 12D-111).