Delaware law requires businesses to assess some personal data risks

Controllers must ensure residents receive notice when a report helps cause an unfavorable decision and may request information and corrections. This applies when a controller shares a report with a third party for a decision with legal or similarly important effects on a Delaware resident. The notice must describe the personal data relied on and explain how to contact the controller. A resident may ask the third party for human review where technically feasible, unless review is not in the resident’s best interest, including when delay could risk life or safety. These duties do not apply to certain consumer credit reports handled under federal law. Within 30 days after a resident asks, the controller must provide the specified data, profiling source, and list of third parties that received a report in the previous 24 months.

Controllers must regularly assess and document risks from certain data uses. The assessment duty applies to a controller processing data of at least 50,000 consumers. Covered uses include targeted advertising, selling personal data, processing sensitive data, and certain profiling that presents a reasonably foreseeable risk of harm. Profiling used for automated decisions with legal or similarly important effects also requires an impact assessment. Data handled only to complete payment transactions is excluded from the consumer count. The Act takes effect January 1, 2027.