Delaware SaaS Agreement Review
Delaware's Personal Data Privacy Act, 6 Del. C. Chapter 12D, took effect January 1, 2025 with a lower threshold than most state laws, and HB 380, signed in September 2026, drops it further on January 1, 2027. It also covers most nonprofits, which many states exempt. For a Wilmington business, or one of the many Delaware corporations with customers in the state, the processor contract terms in the Act should already be in your SaaS paperwork.
Consumer privacy law in Delaware
Delaware Personal Data Privacy Act (DPDPA)
Data rights in Delaware
Delaware has enacted the Delaware Personal Data Privacy Act (DPDPA), a comprehensive consumer privacy law. It gives residents rights over their personal data, typically access, correction, deletion, and the ability to opt out of the sale of data and targeted advertising, and generally requires vendors to sign a data-processing agreement. When you buy SaaS that will hold data about Delaware residents, the vendor's terms should line up with those obligations.
The clauses that decide your risk
- Data use & AI training, is your data used only to provide the service, or to "improve" (train) the vendor’s models?
- Liability cap, often just one month of fees, against real data-loss exposure
- Auto-renewal, the cancellation-notice window (miss it and you renew for a year)
- Price increases, capped, or unilateral at renewal?
- Data export & deletion on termination, can you get your data out, and is it deleted?
- Uptime SLA and service credits
Who does the Delaware privacy act reach?
Today the law applies to a business that controls or processes data of 35,000 Delaware consumers, or 10,000 while earning more than 20% of revenue from selling data. From January 1, 2027 those figures fall to 10,000 and 5,000, and third parties that acquire data from a controller are brought in. Nonprofits are not exempt as a class.
Opt-out preference signals had to be honored no later than January 1, 2026.
What must a Delaware processor contract contain?
Section 12D-107 requires a binding contract setting out processing instructions, the nature, purpose and duration of processing, and the type of data. The processor must keep data confidential, delete or return it at the end of service, give the controller information to show compliance, allow reasonable assessments, and use subcontractors only under written contracts after giving the controller a chance to object. The 2027 amendments, enacted as HB 380 in September 2026, also add vendor diligence and contracting expectations.
Breach notice under 6 Del. C. 12B-102 is due within 60 days, with the Attorney General told when more than 500 residents are affected.
Data protection assessments in Delaware
Controllers must conduct and document data protection assessments for higher risk processing, such as targeted advertising, selling data, or processing sensitive data. The duty covers processing activities created or generated on or after July 1, 2025 and is not retroactive. If your SaaS vendor powers that processing, the contract should require it to cooperate with your assessment and supply the technical detail you need.
Delaware sources checked 2026-10-09: Delaware Code Title 6, Chapter 12D · IAPP, Delaware enacts HB 380 · Ashurst Perkins Coie, Delaware breach chart. Laws change; confirm the current rule before relying on it.
Delaware SaaS agreement FAQ
Does Delaware have a data privacy law that affects SaaS contracts?
Yes. Delaware has enacted a comprehensive consumer privacy law, the Delaware Personal Data Privacy Act (DPDPA). It gives residents rights over their personal data (such as access, deletion, and opting out of sale or targeted advertising) and generally requires a data-processing agreement, which shapes what a SaaS vendor can do with data about Delaware residents.
Can a SaaS vendor use my Delaware business's data to train AI?
Only if the contract lets them. Many SaaS agreements grant the vendor a right to use "customer data" to "improve the services," which can extend to training models. Regardless of Delaware law, insist the contract says your data is never used to train shared or general-purpose models and is processed only to provide the service to you.
What should I check before signing a SaaS agreement in Delaware?
The clauses that decide your risk: how your data can be used (and whether it trains AI), the liability cap versus your data-loss exposure, auto-renewal and the cancellation-notice window, unilateral price increases, and whether you can export and require deletion of your data on termination. ClauseAudit flags each against Delaware law in about a minute.
Does Delaware charge sales tax on a SaaS subscription?
Delaware has no general sales tax, so a Delaware buyer does not pay sales tax on software subscriptions. The state instead levies a gross receipts tax on sellers, which a vendor may factor into its pricing. Check whether the contract allows the vendor to add new taxes or surcharges on top of the agreed fee.
Must a Delaware SaaS vendor offer credit monitoring after a breach?
If Social Security numbers were exposed, Delaware's breach law requires one year of free credit monitoring. A vendor whose systems caused the incident should bear that cost, so look for it in the indemnity or the security exhibit rather than leaving it to the general liability cap.
Reviewing a SaaS contract in Delaware?
Upload it and get the data, liability, and renewal terms checked against Delaware law in about a minute.
State privacy-law status summarized as of October 2026; this area changes quickly and thresholds and effective dates vary. This is automated educational information, not legal advice, ClauseAudit verifies current Delaware law when you run your agreement, and you should confirm anything critical with a qualified attorney.