6 Del. C. § 12D-107A: Duties of third parties [Effective Jan. 1, 2027].

(a) A third party that receives personal data from a controller or processor and does not have a contract as required by this chapter may not further process personal data disclosed to the third party.

(b) A third party must comply with the terms of any contract required by this chapter.

(c) A third party must provide necessary information to enable the controller to conduct and document data protection assessments as required under this chapter.

(d) A third party must provide necessary information for the controller or the controller’s designated assessor to assess the third party consistent with § 12D-106(a)(11) of this title.

(e) A third party subject to this chapter under § 12D-103(a)(1) or (2) of this title must comply with all provisions of this chapter.