Businesses must notify Delaware officials about certain breaches

A person responsible for a security breach must notify the Delaware Attorney General within 60 days when the person later determines that Delaware residents’ information was included. This applies when the person could not identify those residents within 60 days despite reasonable diligence. The person must notify the affected residents as soon as practicable after identifying them. The person does not have to provide separate resident notice if it provides or already provided substitute notice under the listed rules. The Attorney General must receive notice within 60 days after the person determines that the breach occurred; resident notice must follow as soon as practicable after the affected residents are identified.

A person may use substitute notice instead of direct notice when the cost of notice exceeds $75,000, more than 100,000 Delaware residents are affected, or contact information is insufficient. Substitute notice applies to Delaware residents affected by a security breach. Substitute notice must include email notice when email addresses are available. It must include a prominent website posting when the person has a website. It must include notice to major statewide media, the person’s major social media platforms, and the Attorney General.

A regulated person is treated as complying with this chapter if it follows breach procedures set by its main state or federal regulator and notifies affected Delaware residents under those procedures. This covers people regulated by state or federal law, including health privacy and financial privacy laws. The person must maintain breach procedures required by its primary or functional regulator. The person must follow those maintained procedures when a breach occurs. The rule applies when a regulated person notifies affected Delaware residents after a security breach under its maintained regulatory procedures.