What happened
Delaware governor Matt Meyer signed amendments to the state's Personal Data Privacy Act on September 2, 2026, effective January 1, 2027. The law has been in force since January 2025. The amendments do two things that matter to employers: they lower the thresholds that decide who is covered, and they narrow the carve out for employment data.
On coverage, the DPDPA currently applies to organisations processing data of at least 35,000 Delaware consumers, or 10,000 where at least 20 percent of revenue comes from selling personal data. From January 2027 those figures drop to 10,000 and 5,000. Civil penalties run up to $10,000 per violation.
On employment, the law has excluded personal data collected for hiring and employment purposes. Employment data is still generally excluded, but data processed in connection with profiling and reports now falls inside the law. The scenario being addressed is the grey zone before a formal background check: an employer asks a vendor, often one using automated decision making, to source, screen or rank candidates, and the output shapes a decision about a Delaware resident. Where that report is not a consumer report handled in line with the Fair Credit Reporting Act, the DPDPA can reach it.
With that comes duty on the controller. It must impose contractual obligations on third parties receiving the report, including notifying the resident of an adverse action and describing the data relied on. On request it must provide, within 30 days, the data held, the source used in profiling, and every third party that obtained a report in the previous 24 months.
The amendments also expand sensitive data to include health treatment or diagnosis, neural data, certain financial data allowing account access, and inferences revealing the same. Impact assessments become mandatory where an organisation processes data of 50,000 or more Delaware consumers for activities carrying heightened risk of harm, including profiling that risks unlawful discrimination, financial injury or intrusion into privacy. An assessment must cover intended uses, foreseeable risks, data categories, performance metrics, known limitations, transparency measures and post deployment monitoring.
Why this is a GRC story
The impact assessment is the artifact regulators will ask for first. It is a document with named content requirements. Teams that already produce AI risk assessments for procurement will find roughly half the work done, and the missing half is usually the performance metrics and known limitations part that vendors do not volunteer.
Human review is now a control, not a courtesy. A resident can request that a person look again at an adverse decision. That only works if a reviewer exists, can see the reasoning, and can reverse it. Automating the outcome and staffing the appeal with the same system is the failure mode this clause anticipates.
What to watch
Watch whether other states copy the "residents" construction, which is the mechanism that lets a privacy law reach employment decisions without formally covering employees. Watch how the Delaware attorney general exercises the assessment power in its first year, since enforcement posture will tell vendors more than the statutory text does.
The work before January is inventory, not drafting. Find every tool that touches recruiting, screening, ranking, review, discipline or termination, note which ones produce a recommendation someone relies on, and check whether a human can explain and reverse it.
Attribution: Analysis based on JD Supra and related public reporting. This article is original commentary, not a repost of the source material.