Delaware governor signs HB 381 on data breach rules

What HB 381 changes

Delaware’s governor has signed HB 381, approving changes to the state’s treatment of data breaches and legal safe harbors. The measure tightens data breach rules and narrows safe harbors associated with HIPAA and GLBA. Those are two distinct changes: stricter breach requirements and a smaller set of circumstances in which the named safe harbors can apply.

A safe harbor is a legal protection that applies when stated conditions are met. Narrowing one means that relying on HIPAA- or GLBA-related status will not cover as broad a range of circumstances under Delaware rules. The signing marks the governor’s approval of HB 381; the enacted text controls the scope of those changes.

What the action means

The development concerns state policy, not a candidate contest or an election. Its practical importance is for organizations evaluating whether an incident triggers Delaware’s breach requirements and whether a HIPAA- or GLBA-related safe harbor applies. The narrower protections make the specific statutory conditions central to that review.

Next steps include identifying the measure’s effective date, any implementation instructions and how Delaware agencies apply the revised standards. Organizations covered by the rules will need to compare their breach-response practices with HB 381’s final language. Voters following state government can distinguish this policy action from campaign activity: it was a governor’s decision on legislation identified as a House bill, with no election or candidate race directly connected to it.