Shown verbatim: the complete text as captured from the official PDF posted by the Delaware General Assembly, fetched 2026-09-25. Page and line markers are part of the official record; nothing is edited or removed. This is the current version. The official bill page.
SPONSOR: Rep. Griffith & Sen. Pinkney
Reps. Osienski, K. Johnson, Morrison, Harris; Sen. Walsh
HOUSE OF REPRESENTATIVES
153rd GENERAL ASSEMBLY
HOUSE BILL NO. 381
AN ACT TO AMEND TITLE 6 OF THE DELAWARE CODE RELATING TO COMPUTER SECURITY BREACHES.
BE IT ENACTED BY THE GENERAL ASSEMBLY OF THE STATE OF DELAWARE:
1 Section 1. Amend Chapter 12B, Subtitle II, Title 6 of the Delaware Code by making deletions as shown by strike
2 through and insertions as shown by underline as follows:
3 § 12B-101. Definitions.
4 For purposes of this chapter:
5 (5) “Notice” means any of the following:
6 a. Written notice.
7 b. Telephonic notice.
8 c. Electronic notice, if the notice provided is consistent with the provisions regarding electronic records
9 and signatures set forth in § 7001 of Title 15 of the United States Code or if the person’s primary means of
10 communication with the resident is by electronic means.
11 d. Substitute notice, if the person required to provide notice under this chapter demonstrates that the cost
12 of providing notice will exceed $75,000, or that the affected number of Delaware residents to be notified exceeds
13 100,000 residents, or that the person does not have sufficient contact information to provide notice. Substitute
14 notice consists of all of the following:
15 1. Electronic notice if the person has email addresses for the members of the affected class of
16 Delaware residents.
17 2. Conspicuous posting of the notice on a website page of the person if the person maintains 1 or
18 more website pages.
19 3. Notice to major statewide media, including newspapers, radio, and television and publication on
20 the major social media platforms of the person providing notice.
21 4. Notice of the breach of security to the Attorney General.
22 § 12B-102. Disclosure of breach of security; notice.
HD : GOG : DS Page 1 of 2 Released: 04/16/2026 11:50 AM
0081530121
23 (c) Notice required by subsection (a) of this section must be made without unreasonable delay but not later than 60
24 days after determination of the breach of security, except in the following situations:
25 (1) A shorter time is required under federal law.
26 (2) A law-enforcement agency determines that the notice will impede a criminal investigation and such law-
27 enforcement agency has made a request of the person that the notice be delayed. Any such delayed notice must be
28 made after such law-enforcement agency determines that notice will not compromise the criminal investigation and so
29 notifies the person of such determination.
30 (3) When a person otherwise required by subsection (a) of this section to provide notice, could not, through
31 reasonable diligence, identify within 60 days that the personal information of certain residents of this State was
32 included in a breach of security, such person must provide the notice required by subsection (a) of this section to such
33 residents as soon as practicable after the determination that the breach of security included the personal information of
34 such residents, and must provide notice of the breach of security to the Attorney General within 60 days after the
35 determination of the breach of security, unless such person provides or has provided substitute notice in accordance
36 with § 12B-101(5)d. of this title. title within 60 days after the determination of the breach of security.
37 § 12B-103. Procedures deemed in compliance with security breach notice requirements.
38 (b) Under this chapter, a person that is regulated by state or federal law, including the Health Insurance Portability
39 and Accountability Act of 1996 (P.L. 104-191, as amended) and the Gramm Leach Bliley Act (15 U.S.C. § 6801 et seq., as
40 amended) and that maintains procedures for a breach of security pursuant to the laws, rules, regulations, guidance, or
41 guidelines established by its primary or functional state or federal regulator is deemed to be in compliance with this chapter
42 § 12B-102(c) of this title if the person notifies affected Delaware residents in accordance with the maintained procedures
43 when a breach of security occurs.
SYNOPSIS
This Act amends Chapter 12B of Title 6 relating to Computer Security Breaches to clarify when businesses must
provide notice of a computer security breach to the Attorney General.
HD : GOG : DS Page 2 of 2 Released: 04/16/2026 11:50 AM
0081530121Every fact on this page links to its source, starting with the official bill record.