DE Narrows Data Privacy Law Exemptions for Financial Institutions

Delaware recently amended the Delaware Personal Data Privacy Act (DPDPA) to eliminate the blanket entity-level exemption for financial institutions (and their affiliates).  As previously reported by WBK here, the DPDPA is currently not applicable to certain entities, including financial institutions and their affiliates to the extent each is subject to Title V of the Gramm-Leach-Bliley Act (GLBA).

The newly-enacted HB 380, however, will narrow the entity-level exemptions for financial institutions.  As of the effective date, entity-level exemptions will apply to federal or state-chartered banks, credit unions, savings associations (and their affiliates or subsidiaries), and various types of insurance industry entities, when such entities are principally engaged in financial activities permitted by the Bank Holding Company Act.  Broker-dealers and other types of investment entities regulated by the Delaware Investor Protection Unit or the SEC will also remain exempt.

While many nondepository financial institutions will no longer have an entity-level exemption, the amendments will not eliminate the exemption for data subject to Title V of the GLBA. 

The amendments are effective January 1, 2027.