Amendments to the Delaware Personal Data Privacy Act (DPDPA) taking effect on January 1, 2027, will introduce stricter data governance and notice requirements for employers and software vendors that use automated profiling reports to evaluate job applicants, employees, and independent contractors. Signed into law by Governor Matt Meyer on September 2, 2026, the legislation substantially lowers the state’s consumer data volume thresholds while creating new compliance obligations for third-party candidate assessments and algorithmic decision-making tools.

Rather than enacting a standalone workplace artificial intelligence statute, Delaware lawmakers integrated these rules into the state’s existing consumer privacy framework, which originally took effect on January 1, 2025. While the baseline statute generally excludes routine employment records, the 2027 amendments bring worker and applicant data into scope when processed in connection with profiling and third-party reports used for consequential employment decisions, according to an analysis by Ogletree Deakins.

Lower Thresholds and Expanded Third-Party Scope

The updated law captures a much wider segment of businesses operating in Delaware or targeting its residents. According to the National Law Review, the amendments reduce the general applicability threshold from 35,000 consumers to 10,000 consumers whose personal data is controlled or processed annually. For organizations that derive more than 20% of their gross revenue from the sale of personal data, the threshold drops from 10,000 to 5,000 consumers.

Under the statute, profiling is defined as any form of automated processing performed on personal data to evaluate, analyze, or predict an individual’s characteristics, including demographics, preferences, reliability, behavior, location, or movements. When this automated processing is used to make decisions that produce legal or similarly significant effects—explicitly including the provision or denial of employment opportunities—specific regulatory safeguards are triggered.

The amendments also impose direct statutory obligations on certain third parties that receive personal data from data controllers, moving beyond standard controller-processor contract requirements. As Sheppard Mullin notes, when a data controller furnishes a covered profiling report to a third party for use in an employment decision, the controller must contractually mandate that the recipient provide specific procedural protections to the affected Delaware resident.

How the Rules Affect Hiring and Management Software

In modern human resources architectures, companies frequently rely on external software vendors to score resumes, analyze video interviews, or generate behavioral predictions for applicants and contractors. Under Delaware’s amended rules, these vendor-generated outputs can qualify as covered reports distinct from traditional background checks governed by the federal Fair Credit Reporting Act (FCRA).

When an employer relies on a covered profiling report furnished by a third party to make an adverse employment decision, the contractual safeguards require the recipient to provide the individual with an adverse-action notice, a clear description of the personal data relied upon to make the decision, information detailing the resident’s statutory rights, and access to human review of the automated determination.

Additionally, according to Ogletree Deakins, Delaware residents gain specific transparency and correction rights regarding these profiles. An individual may request access to the personal data maintained about them, identify the specific sources of data fed into the profiling system, obtain a list of all third parties that received a report about them during the previous 24 months, and demand the correction of inaccurate data. Controllers must respond to these inquiries within 30 days.

Navigating Statutory Ambiguities and Exemptions

Because Delaware grafted these profiling rules onto a consumer privacy statute that otherwise exempts workforce data, legal analysts point to varying interpretations regarding how broadly the law applies to internal HR software versus external vendor reports.

For example, the amendments remove the word “solely” from the statute’s profiling opt-out provision. According to the National Law Review, this broadens the consumer opt-out right to cover automated processing that facilitates significant decisions even when a human reviewer is involved in the loop. However, legal reports diverge on how this applies to the workplace. While Ogletree Deakins highlights that applicant and employee data is brought into scope when tied to profiling and consequential reports, an analysis on Substack reports that the statute does not create an employment-context opt-out right because general employment data remains excluded from baseline consumer rights.

A similar distinction surrounds data protection impact assessments. The amended law requires controllers that process the personal data of 50,000 or more consumers to conduct formal impact assessments for heightened-risk processing, which includes profiling that presents a reasonably foreseeable risk of unlawful discrimination, financial injury, or privacy intrusion. However, the Substack commentary notes that Delaware expressly exempts the employment context from these impact-assessment mandates, meaning the law does not establish a universal requirement to audit internal workplace AI systems.

Regardless of where the boundary between internal HR tools and external profiling reports settles, the statute explicitly prohibits processing personal data or conducting automated profiling in violation of state or federal anti-discrimination laws. Exclusive enforcement authority remains with the Delaware Department of Justice, and the statute provides no private right of action for individuals to sue directly under the privacy law.

Frequently Asked Questions

How do covered profiling reports in Delaware differ from FCRA background checks?

Traditional background checks used for hiring are regulated as consumer reports under the federal Fair Credit Reporting Act (FCRA). Delaware’s amendments target automated profiling reports that evaluate or predict characteristics like behavior, reliability, or preferences but may fall outside the strict statutory definition of an FCRA consumer report. Employers using vendors that combine both types of data will need to ensure their workflows satisfy both federal FCRA adverse-action timelines and Delaware’s specific disclosure and human-review requirements.

Can job applicants opt out of automated hiring assessments entirely?

Legal interpretations vary on the practical reach of the opt-out provision in hiring. While the amendments expand consumer opt-out rights to cover automated profiling even when human review is present, employment data remains generally excluded from the law’s standard consumer rights framework. Consequently, workplace protections focus primarily on transparency, data correction, adverse-action notices, and access to human review when third-party profiling reports are used, rather than a blanket right for employees to opt out of internal management software.

What technical and contractual steps should employers take before January 1, 2027?

Organizations meeting the lowered 10,000-consumer threshold should audit their recruiting and workforce management tech stacks to identify any third-party tools that generate candidate scores, behavioral assessments, or profiling reports for Delaware residents. Employers and data controllers must update vendor contracts to enforce the required adverse-action disclosures, establish a formal workflow to provide human review of contested automated decisions, and build data-retrieval pipelines capable of fulfilling 24-month third-party disclosure requests within the 30-day statutory window.

Sources

Read More