ShareAndGoShareAndGo

Data breach notification

Delaware data breach notification law

Delaware's Computer Security Breaches chapter, 6 Del. C. §§ 12B-101 to 12B-104, puts the notice duty in § 12B-102.

Who must be told, and when

Delaware residents must be notified "without unreasonable delay but not later than 60 days after determination of the breach of security."

If the number of Delaware residents to be notified exceeds 500, the Attorney General must also be notified, not later than the time notice is provided to the residents.

So a breach touching more than 500 Delaware residents means two notices, to the residents and to the Attorney General, while one touching 500 or fewer means notice to the residents only.

Personal information in the Delaware chapter

Personal information is a Delaware resident's first name or first initial and last name combined with one or more listed elements. The list runs to nine items:

  • Social Security number
  • driver's license or state or federal identification card number
  • account or card number with any required code or password
  • passport number
  • username or email address with a password or security question and answer
  • medical history, treatment or diagnosis, or a DNA profile
  • health insurance policy, subscriber or other insurer identifier
  • unique biometric data generated from measurements of human body characteristics for authentication
  • an individual taxpayer identification number

Exceptions and extra steps

Notice is not owed if, after an appropriate investigation, the person reasonably determines that the breach of security is unlikely to result in harm to the individuals whose information was breached.

Unauthorized acquisition of encrypted information is not a breach of security, unless the acquisition includes, or is reasonably believed to include, the encryption key.

When a Social Security number is breached, one year of credit monitoring must be offered at no cost, unless the harm exception applies.

Where ShareAndGo fits

For documents you share through ShareAndGo, the activity log records every view and download, and watermarked view-only pages carry the reader's email address and the date.

Per-viewer watermarks are on by default in each room and can be set differently room by room. Six-digit email codes confirm who each reader is without asking them to create an account. Folder access follows the group a reader belongs to, so a buyer's advisers never see the lender's folder. When someone asks who opened a given file, the chained log answers in a CSV with names, actions and dates.

Delaware questions

What is Delaware's deadline?
Without unreasonable delay but not later than 60 days after determination of the breach of security.
When is the Attorney General involved?
When more than 500 Delaware residents are to be notified. The Attorney General is notified no later than the residents.
Is a DNA profile covered?
Yes. Medical history, treatment or diagnosis, or a DNA profile, is on the list.
Does credit monitoring apply?
Where a Social Security number is breached, one year of credit monitoring must be offered at no cost, unless the harm exception applies.

Last checked

Checked against Delaware's published law on November 2, 2026. This is general information, not legal advice.

Explore more

Breach notification laws by state

Notice rules across the country.

ShareAndGo vs DataRooms.com

How two data rooms compare.

ShareAndGo

ShareAndGo home.