Compliance FrameworksAmericas
Delaware PDPA
Delaware Personal Data Privacy Act - controller obligations, consumer rights, sensitive data.
Delaware Personal Data Privacy Act - controller obligations, consumer rights, sensitive data.
| Short name | DE PDPA |
| Region | Americas |
| Country or scope | United States |
| Sector | Privacy |
| In your workspace | On unless you switch it off in Compliance › Manage. |
How Safeguard covers DE PDPA
- Scan requirements: 6, all decided by a scan.
- Controls: the scan requirements below, plus 9 controls from Safeguard's control catalog for DE PDPA.
- Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
- Policy templates: 24: 2 written for DE PDPA and 22 from the standard set.
How each kind of coverage works, and what the readiness score counts: Compliance frameworks.
What a scan checks
Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).
| Requirement | What Safeguard checks | Decided by |
|---|---|---|
DE-PDPA-SEC Data Security Practices | Controllers must establish, implement and maintain reasonable administrative, technical and physical data security practices appropriate to the volume and nature of the personal data; integrity-verifiable processing software evidences that duty (6 Del. C. ch. 12D, controller-duties provision) | Scan |
DE-PDPA-MIN Minimisation Accountability | Collection of personal data must be limited to what is adequate, relevant and reasonably necessary for the disclosed purposes, which presumes an inventory of the software components through which that data flows (6 Del. C. ch. 12D, controller-duties provision) | Scan |
DE-PDPA-PROC Processor Obligations | Processors must adhere to controller instructions under binding contracts, assist with security and assessments, and bind subcontractors equivalently; third-party components should carry named suppliers to demonstrate this oversight (6 Del. C. ch. 12D, processor provisions) | Scan |
DE-PDPA-DPIA Data Protection Assessment Readiness | Data protection assessments are required for heightened-risk processing such as targeted advertising, sale, risky profiling and sensitive data; recorded software versions are the basis for credible risk assessment (6 Del. C. ch. 12D, data protection assessment provisions) | Scan |
DE-PDPA-RIGHTS Consumer Rights Fulfilment | Consumers may access, correct, delete and port personal data, obtain a list of third-party recipient categories, and opt out including via universal opt-out signals; the processing components must be unambiguously identifiable to execute these rights (6 Del. C. ch. 12D, consumer-rights provisions) | Scan |
DE-PDPA-NOTICE Privacy Notice Documentation | Controllers must provide a reasonably accessible, clear and meaningful privacy notice covering processing purposes and sharing; supporting documentation should be identified and timestamped so disclosures remain auditable (6 Del. C. ch. 12D, transparency provisions) | Scan |
More controls in the catalog
The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.
| Control | Name |
|---|---|
DE-6-12D-102C | Consumer Rights: Access, Correction, Deletion & Portability |
DE-6-12D-102D | Opt-Out of Sale, Targeted Advertising & Profiling |
DE-6-12D-103 | Sensitive Data Consent |
DE-6-12D-107 | Data Protection Assessment |
DE-6-12D-108 | Processor Agreements |
DE-6-12D-101 | Privacy Notice |
DE-6-12D-104 | Children's Data Protections |
DE-6-12D-105 | Universal Opt-Out Signal Recognition |
DE-6-12D-106 | Consumer Appeals |
Policy templates
Written for DE PDPA:
- Delaware PDPA State Privacy Notice
- Delaware PDPA Consumer Rights Request Handling Procedure
And 22 from the standard set, adapted to DE PDPA.