Delaware Governor Matt Meyer signed two data privacy bills into law recently, expanding consumer privacy protections and changing how businesses must respond to data breaches.

HB 380 strengthens Delaware’s Personal Data Privacy Act by adding new requirements around sensitive data, consumer privacy rights, profiling, automated decision-making, and third-party data sharing. Federally-chartered credit unions remain exempt from these expanded requirements and will continue to operate under their existing GLBA and NCUA privacy framework.

The law could still have an indirect impact on credit unions through CUSOs, fintech companies, AI providers, and other vendors that may not qualify for an exemption. Credit unions should review vendor relationships and data-sharing agreements involving Delaware members before HB 380 takes effect on January 1, 2027.

HB 381, which took effect September 2, 2026, changes Delaware’s data-breach notification law. Credit unions can continue following NCUA and GLBA procedures for notifying affected members, but the law creates a separate consideration for reporting breaches to the Delaware Attorney General.

Under the new law, notice to the Attorney General is required within 60 days of determining that a breach occurred, regardless of how many Delaware residents are affected. Previously, Attorney General notification generally applied only when more than 500 Delaware residents were impacted.

Credit unions should review breach-response procedures to make sure the new Delaware Attorney General reporting requirement is addressed. They should also review CUSO and vendor agreements  in light of HB 380’s third-party obligations to confirm that the credit union’s practices meet these new Delaware requirements.