Data Security Breaches
As of April 14, 2018, Delaware’s security breach notification law requires any person who conducts business in Delaware and who owns, licenses, or maintains personal information of Delaware residents, to notify Delaware residents when the personal information of those Delaware residents has been subject to a data security breach. Notice must be provided without unreasonable delay, but not more than 60 days following discovery of the security breach, unless the person suffering the breach determines, after an appropriate investigation, that the breach is unlikely to result in harm.
Search for Data Security Breach Notices
When a security breach affects more than 500 Delaware residents, the person must also provide notice to the Delaware Attorney General. For a list of those notices, please click on the link below.
Reporting a Data Security Breach
Delaware’s data security breach law requires two different types of notice. The first is notice to Delaware residents whose personal information has been subject to a security breach. The second is notice to the Delaware Attorney General when the security affects more than 500 Delaware residents. The Consumer Protection Unit is making forms available for both types of notice.
Notice to Consumers and Other Affected Persons
Delaware law does not require a specific form of notice in order to notify Delaware residents that their personal information has been subject to a security breach. To provide assistance and guidance to persons required to provide notice to Delaware residents, a Model Data Security Breach Notification Form is available in the Helpful Resources box below or at this link.
The Consumer Protection Unit will deem use of the Model Data Security Breach Notification Form to constitute appropriate written notice to affected Delaware residents under Delaware’s data security breach notification law. Other forms of written or electronic notice may be appropriate, but for ease of reading and accessibility the Consumer Protection Unit strongly encourages use of similar headings together with plain, accessible, and non-technical language.
Notice to the Delaware Attorney General
Persons required to provide notice of a data security breach to the Delaware Attorney General should use the online web form or the fillable PDF form available at the following links:
The Consumer Protection Unit will deem use of either of the foregoing forms to constitute appropriate written notice to the Attorney General required under Delaware’s data security breach notification law. Other forms of written or electronic notice may be appropriate, but must provide the same information sought by this form.
Helpful Resources
Documents:
Related Topics: Attorney General, Breach, Consumer Protection Unit, Data, Delaware, Information, Notification, Security
