Did You Know?

• Breach reporting and notifications must be completed within 60 days
• Vendors are required to report to the data owner immediately following determination that a breach of security has occurred
• If the breach of security includes a Social Security number, each affected resident shall be offered credit monitoring services at no cost to them for a period of 1 year
• A Delaware entity that owns, licenses or maintains personal information, must implement and maintain reasonable procedures and practices to prevent the unauthorized acquisition, use, modification, disclosure, or destruction of personal information
• The state attorney general may bring an action in law or equity to address violations and for other relief that may be appropriate to ensure proper compliance or to recover direct economic damages, or both
• Delaware has additional laws regarding personal data protection and rights such as:
  • Student Data Privacy Protection Act
  • Delaware Online Privacy and Protection Act (compliments Federal COPPA laws)
  • Safe Destruction of Records Containing Personal Identifying Information
  • Right to Inspect Personnel Files Act (employment)
• If your breach affects residents in other states you will need to notify those residents using that state’s rules
• Federal laws, industry regulations, and/or out-of-country laws may also apply