{"data":{"id":"us-de/6-del.-c.-12d-106--2","jurisdiction":"us-de","citation":"6 Del. C. § 12D-106","heading":"Duties of controllers [Effective Jan. 1, 2027].","body":"(a) A controller shall do all of the following:\n(1) Limit the processing of personal data to what is reasonably necessary and proportional in relation to the purposes for which such data is processed, as disclosed to the consumer.\n(2) Except as otherwise permitted by this chapter, not process personal data for any additional purpose that is not reasonably necessary and proportionate to the disclosed purposes for which such personal data is processed, as disclosed to the consumer at the time of collection, unless the controller obtains the consumer’s consent.\n(3) Establish, implement, and maintain reasonable administrative, technical, and physical data security and privacy practices to protect the confidentiality, integrity, and accessibility of personal data appropriate to the volume and nature of the personal data at issue.\n(4) Not process sensitive data concerning a consumer unless all of the following conditions are met:\na. The consumer consents to the processing of sensitive data.\nb. The processing of sensitive data is reasonably necessary and proportionate to the disclosed purposes for processing sensitive data.\n(5) Not process personal data of a consumer when the controller has actual knowledge or wilfully disregards that the consumer is a child, without first obtaining consent from the child’s parent or lawful guardian and otherwise complying with § 1204C of this title.\n(6) Not process personal data or engage in profiling in violation of the laws of this State and federal laws that prohibit unlawful discrimination. Evidence or lack of evidence concerning proactive anti-bias testing or any similar proactive effort to avoid processing personal data in violation the laws of this State, including evidence or lack of evidence concerning the quality, efficacy, recency, and scope of any such testing or effort, the results of such testing or effort, and the response to the results of such testing or effort, are relevant to any claim for a violation of the laws of this State and any available defense to such claims.\n(7) Provide an effective mechanism for a consumer to revoke the consumer’s consent under this section that is at least as easy as the mechanism by which the consumer provided the consumer’s consent and, upon revocation of such consent, cease to process the data as soon as practicable, but not later than 15 days after the receipt of such request.\n(8) Not process the personal data of a consumer without the consumer’s consent for any purpose listed in § 12D-104(a)(6) of this title under circumstances where a controller has actual knowledge or wilfully disregards that the consumer is at least 13 years of age but younger than 18 years of age.\n(9) Not discriminate against a consumer for exercising any of the consumer rights contained in this chapter, including denying goods or services, charging different prices or rates for goods or services, or providing a different level of quality of goods or services to the consumer.\n(10) Enter into binding contractual agreements with third parties to whom personal data is disclosed, including in a sale of personal data or for targeted advertising. The contractual agreement must include all of the following terms and conditions:\na. Specifying that the personal data is sold or disclosed by the controller only for limited and specified purposes, including whether the purpose includes use for decisions that produce legal or similarly significant effects.\nb. Obligating the third party to comply with this chapter and obligating the third party to provide the same level of privacy protection as is required by this chapter.\nc. Granting the controller rights to take reasonable and appropriate steps to ensure that the third party uses the personal data transferred by the controller in a manner consistent with the controller’s obligations under this chapter.\nd. Requiring the third party to notify the controller if it makes a determination that it can no longer meet its obligations under this chapter.\ne. Granting the controller the right upon notice to take reasonable and appropriate steps to stop and remediate unauthorized use of personal data.\n(11) Conduct reasonable due diligence, either by the controller or through a designated assessor, of third parties to whom the controller discloses personal data, including the sale of personal data and targeted advertising, to assess the third party’s policies and technical and organizational measures undertaken to support compliance with the obligations under this chapter and to demonstrate compliance under this chapter as it relates to the personal data that the controller discloses to the third party or that the controller anticipates disclosing to third party. Reasonable due diligence involves, at a minimum, assessing the third party through the use of questionnaires and review of relevant documents of the third party. Additional reasonable measures must be undertaken in a manner that is commensurate with the sensitivity of the data disclosed by the controller to the processor or third party.\n(12) Not disclose sensitive data in a sale of personal data unless all of the following apply:\na. The disclosure of sensitive data is strictly necessary to provide or maintain a product or service affirmatively requested by the consumer to whom the sensitive data pertains.\nb. The controller provides a clear and conspicuous notice of the sale of personal data before the sale of personal data, which must include the specific categories of sensitive data to be disclosed, the purpose of the disclosure, and identifies the third parties to which sensitive data will be disclosed.\nc. The controller obtains the consumer’s consent.\nd. The controller maintains a record of the consumer’s consent for a period of 5 years.\ne. The record of consent of Delaware consumers must be provided with any data protection assessment produced under § 12-108(c) of this title.\n(b) Nothing in subsection (a) of this section shall be construed to require a controller to provide a product or service that requires the personal data of a consumer which the controller does not collect or maintain, or prohibit a controller from offering a different price, rate, level, quality, or selection of goods or services to a consumer, including offering goods or services for no fee, if the offering is in connection with a consumer’s voluntary participation in a bona fide loyalty, rewards, premium features, discounts, or club card program.\n(c) A controller shall provide consumers with a reasonably accessible, clear, and meaningful privacy notice reasonably particular to the product or service offered to the consumer that includes all of the following:\n(1) The categories of personal data processed by the controller.\n(2) The purpose for processing personal data.\n(3) How consumers may exercise their consumer rights, including how a consumer may appeal a controller’s decision with regard to the consumer’s request.\n(4) The categories of personal data that the controller shares with third parties, if any.\n(5) The categories of third parties with which the controller shares personal data, if any.\n(6) Identification of the controller and an active electronic mail address or other online mechanism that the consumer may use to contact the controller.\n(7) A description of the consumer personal data rights under § 12D-104(a) of this title.\n(d) If a controller processes personal data for any purpose under § 12D-104(a)(6) of this title, the controller must clearly and conspicuously disclose such processing, as well as the manner in which a consumer may exercise the right to opt out of such processing.\n(e) (1) A controller shall establish, and shall describe in the privacy notice required by subsection (c) of this section, 1 or more secure and reliable means for consumers to submit a request to exercise their consumer rights under this chapter. Such means shall take into account the ways in which consumers normally interact with the controller, the need for secure and reliable communication of such requests, and the ability of the controller to verify the identity of the consumer making the request. A controller may not require a consumer to create a new account in order to exercise consumer rights, but may require a consumer or the consumer’s authorized agent to use an existing account. Any such means shall include all of the following:\na. 1. Providing a clear and conspicuous link on the controller’s Internet website or application to an Internet web page or interface that enables a consumer, or an agent of the consumer, to opt out of the processing of personal data for any purpose listed in § 12D-104(a)(6) of this title.\n2. Not later than January 1, 2026, allowing a consumer to opt out of any processing of the consumer’s personal data for the purposes of targeted advertising, or any sale of such personal data, through an opt-out preference signal sent, with such consumer’s consent, by a platform, technology, or mechanism to the controller indicating such consumer’s intent to opt out of any such processing or sale. Such platform, technology, or mechanism shall do all of the following:\nA. Not unfairly disadvantage another controller.\nB. Not make use of a default setting, but, rather, require the consumer to make an affirmative, freely given, and unambiguous choice to opt out of any processing of such consumer’s personal data pursuant to this chapter.\nC. Be consumer friendly and easy to use by the average consumer.\nD. Be as consistent as possible with any other similar platform, technology, or mechanism required by any federal or state law or regulation.\nE. Enable the controller to reasonably determine whether the consumer is a resident of the State and whether the consumer has made a legitimate request to opt out of any sale of such consumer’s personal data or targeted advertising.\nb. If a consumer’s decision to opt out of any processing of the consumer’s personal data for the purposes of targeted advertising, or any sale of such personal data, through an opt-out preference signal sent in accordance with the provisions of paragraph (e)(1)a. of this section conflicts with the consumer’s existing controller-specific privacy setting or voluntary participation in a controller’s bona fide loyalty, rewards, premium features, discounts or club card program, the controller shall comply with such consumer’s opt-out preference signal but may notify such consumer of such conflict and provide to such consumer the choice to confirm such controller-specific privacy setting or participation in such program.\n(2) If a controller responds to consumer opt-out requests received pursuant to paragraph (e)(1)a. of this section by informing the consumer of a charge for the use of any product or service, the controller shall present the terms of any financial incentive offered pursuant to paragraph (e)(1)b. of this section for the retention, use, sale, or sharing of the consumer’s personal data.\n(f) A controller disclosing to any third party a report for use in connection with any decision that produces legal or similarly significant effects concerning a resident must:\n(1) In addition to the requirements of paragraph (a)(10) of this section, enter into a contractual agreement with the third party requiring the third party to do the following:\na. Provide notice to a resident of any adverse action that is based in whole or in part on any information contained in the report.\nb. Provide a description of the personal data relied upon in making the adverse action.\nc. Include a statement that the resident may obtain the information described under paragraph (f)(2) of this section from the controller with appropriate contact information for the controller.\nd. Include a statement that the resident may request the third party, where technically feasible, perform a human review of the adverse action concerning the resident, unless providing the opportunity for review is not in the best interest of the resident, including instances in which any delay might pose a risk to the life or safety of the resident.\n(2) Upon request from a resident, provide the following information within 30 days:\na. Personal data maintained by the controller concerning the resident at the time of the request.\nb. The source of the personal data used in profiling.\nc. Identification of all third parties who obtained a report concerning the resident within the previous 24-months.\n(3) Provide the resident an opportunity to correct any incorrect personal data.\n(g) Nothing in subsection (f) of this section applies to a controller or third party when the report or personal data consists of a score, a model, an algorithm, or similar output that is a consumer report, or would be a consumer report if furnished to a third party, and is furnished or disclosed in compliance with the Fair Credit Reporting Act, 15 U.S.C. § 1681 et. seq.","path":["Title 6. Commerce and Trade","Subtitle II. Other Laws Relating to Commerce and Trade","Chapter 12D. Delaware Personal Data Privacy Act"],"source_url":"https://delcode.delaware.gov/title6/title6.pdf","current_through":"2026-10-01 (85 Del. Laws, c. 550)","vintage":"","retrieved_at":"2026-10-21T05:48:50Z","sha256":"a3c3b204c0ae2810c0002b2cad569fc09cf65b561d9609688b67373a6914c94f","source_id":"us-de","stale":false,"prev":"us-de/6-del.-c.-12d-106","next":"us-de/6-del.-c.-12d-107"},"notice":"GroundRules: Original legal text. Not legal advice."}