If your company sells personal data to third parties or shares it for targeted advertising, Delaware just became the state to watch. The same still holds true for processors.
Delaware House Bill 380, effective January 1, 2027, amends the state’s existing privacy law with the most prescriptive third-party due diligence requirements of any U.S. state privacy law to date. Compliance will take real lead time to build, so the smart move is to start now, not in Q4 2026.
From Monday, September 21st, you have 70 business days to get this right.
What HB380 actually requires
If you’re a data controller, HB380 requires “reasonable due diligence” on any third party you disclose personal data to, including sales and targeted advertising disclosures.
Most state laws leave “reasonable” vague. Delaware doesn’t. At minimum, HB380 requires:
- Questionnaires assessing the third party’s privacy policies and technical/organizational safeguards
- Documents to verify those answers
That’s the floor, not the ceiling. More sensitive data disclosures may require additional measures beyond questionnaires and documents.
Your vendors don’t get to opt out
HB380 also obligates third parties and processors to cooperate: they must provide the information you (or your auditor) need to complete your diligence. If a vendor won’t engage with your questionnaire or document requests, that’s now a compliance gap.
How The IAB Diligence Platform, Powered by SafeGuard Privacy, gets you there
This is what our privacy compliance platform was built to do, and already meets the requirements of the Delaware law:
- Questionnaires: Use our comprehensive assessments with your third parties. The Multistate Substantial Compliance Assessment (MSCA) alone gives you a single, comprehensive response covering Delaware plus every other U.S. state privacy law, with no need to run separate processes per state.
- Document collection: Third parties submit supporting documentation alongside their questionnaire answers, all in one place, all audit-ready.
- Ad tech coverage: If you operate in digital advertising, SafeGuard Privacy powers the IAB Diligence Platform, which includes the IAB Data Supplier Diligence questionnaire, for deeper assessment of third-party processing activities.
Onboarding is fast. Most customers start sending assessments to vendors within hours.
The bottom line
Delaware set a new bar, and other states will likely follow its lead. Getting your third-party diligence program in shape now, with 70 business days before the January 1st, 2027 deadline, is imperative. The IAB Diligence Platform, Powered by SafeGuard Privacy, helps you clear the bar.