Attorneys at Saul Ewing LLP write:
On September 2, 2026, HB 381 was signed into law and amends Delaware’s data breach notification statute effective immediately. The new Delaware breach law includes a 60-day notice provision to the Delaware Attorney General, narrows the safe harbor for institutions covered by the Gramm-Leach-Bliley Act (GLBA) and entities regulated under HIPAA, and adds the Delaware Attorney General as part of a substitute notice process.
HB 381 enhances and expands Delaware’s data breach notification requirements. Under the new law, businesses that experience a data breach must notify the Delaware Attorney General within 60 days after determining that a breach has occurred even when a business cannot, despite reasonable diligence, identify which Delaware residents were affected.
… The enactment of HB 381 now forces organizations holding information on Delaware residents, including health care providers, to potentially report complex or ongoing forensic investigations to the Delaware Attorney General before an investigation may be complete. Under the prior version of the statute, organizations could wait for the conclusion of a forensic investigation, which can often take weeks or months, before notifying affected individuals. HB 381 does not change the requirement that the Delaware Attorney General be notified when the affected number of Delaware residents from a breach exceeds 500 individuals. Instead, HB 381’s early reporting and substitute notice requirements operate in addition to the existing statutory requirement.
Under Delaware’s HB 381, compliance with federal HIPAA or GLBA breach-notification rules no longer provides a blanket exemption from Delaware’s state-level requirements. Instead, compliance with a federal regulator’s breach procedures now satisfies only Delaware’s 60-day timing requirement, but organizations remain subject to the other provisions of the state’s breach notification laws.
Read more at JDSupra.
