美国特拉华州《关于修订特拉华法典第6编涉及计算机安全漏洞的法案》（众议院第381号法案）
简称：美国特拉华州计算机安全漏洞（数据泄露通知）法修正案（HB 381 / 85 Del. Laws c. 464）
法规简介
2026年9月2日，美国特拉华州州长 Matt Meyer 签署众议院第381号法案（HB 381），修订特拉华法典第6编第12B章（计算机安全漏洞 / Computer Security Breaches，即该州数据泄露通知法），编入《特拉华州法律》第85卷第464章，自签署之日（2026年9月2日）起施行。该法案与同日签署的 HB 380（个人数据隐私法修订）共同构成州长办公室所称"全美最广泛数据保护"的一揽子立法。 【核心内容】 1. 明确"通知（Notice）"的定义与形式（第12B-101(5)条）：书面通知、电话通知、符合《美国法典》第15编第7001条电子记录与签名规定的电子通知，以及替代性通知（Substitute notice）。 2. 细化替代性通知的适用条件与构成：当通知费用超过75,000美元、受影响的特拉华州居民超过100,000人，或缺乏足够联系方式时，可采用替代性通知；替代性通知须同时包含——（1）向有邮箱的受影响居民发送电子通知；（2）在自有网站的显著位置张贴；（3）通知全州主要媒体（报纸、广播、电视）并在自有主要社交平台发布；（4）向州总检察长通报该安全漏洞。 3. 澄清向总检察长通报的时限（第12B-102(c)(3)条）：一般要求为"不得不合理迟延，且自认定发生安全漏洞之日起不超过60日"；保留联邦法要求更短期限、执法机关要求延迟两项例外；若经合理勤勉仍无法在60日内识别特定本州居民的个人数据是否被涉及，则应在识别后尽快通知该等居民，并须自认定安全漏洞之日起60日内向总检察长通报（已提供替代性通知的除外）。 4. 明确受监管实体的"合规安全港"（第12B-103(b)条）：受州或联邦法律监管的主体（明确列举 HIPAA 与Gramm-Leach-Bliley 法），若已依据其主要或功能性州/联邦监管机构所确立的法律、规则、指引建立安全漏洞处置程序，并在发生漏洞时依该程序通知受影响的特拉华州居民，即视为符合本章的通知要求。 【合规提示】本法案属技术性澄清，但对 incident response 实务影响直接：（1）企业应将"60日内通报州总检察长"作为独立计时项纳入泄露响应流程，而非仅以"通知居民"为节点；（2）替代性通知的四种形式须全部满足，缺一不可；（3）金融与医疗行业主体可依托既有监管程序主张合规安全港，但须确保实际按该程序向特拉华州居民履行通知。
【说明】以下为美国特拉华州第153届议会众议院第381号法案最终通过文本官方 PDF 全文
（特拉华州议会官网，共 2 页，含完整文字层）。该法案于 2026 年 9 月 2 日由州长 Matt Meyer 签署，
编入《特拉华州法律》第 85 卷第 464 章（85 Del. Laws c. 464），州长顾问编号第 57 号，
自签署之日（2026 年 9 月 2 日）起施行。与同日签署的 HB 380（个人数据隐私）构成"数据保护一揽子立法"。
==================================================
SPONSOR: Rep. Griffith & Sen. Pinkney
Reps. Osienski, K. Johnson, Morrison, Harris; Sen. Walsh
HOUSE OF REPRESENTATIVES
153rd GENERAL ASSEMBLY
HOUSE BILL NO. 381
AN ACT TO AMEND TITLE 6 OF THE DELAWARE CODE RELATING TO COMPUTER SECURITY BREACHES.
BE IT ENACTED BY THE GENERAL ASSEMBLY OF THE STATE OF DELAWARE:
Section 1. Amend Chapter 12B, Subtitle II, Title 6 of the Delaware Code by making deletions as shown by strike
through and insertions as shown by underline as follows:
§ 12B-101. Definitions.
For purposes of this chapter:
(5) “Notice” means any of the following:
a. Written notice.
b. Telephonic notice.
c. Electronic notice, if the notice provided is consistent with the provisions regarding electronic records
and signatures set forth in § 7001 of Title 15 of the United States Code or if the person’s primary means of
communication with the resident is by electronic means.
d. Substitute notice, if the person required to provide notice under this chapter demonstrates that the cost
of providing notice will exceed $75,000, or that the affected number of Delaware residents to be notified exceeds
100,000 residents, or that the person does not have sufficient contact information to provide notice. Substitute
notice consists of all of the following:
1. Electronic notice if the person has email addresses for the members of the affected class of
Delaware residents.
2. Conspicuous posting of the notice on a website page of the person if the person maintains 1 or
more website pages.
3. Notice to major statewide media, including newspapers, radio, and television and publication on
the major social media platforms of the person providing notice.
4. Notice of the breach of security to the Attorney General.
§ 12B-102. Disclosure of breach of security; notice.
(c) Notice required by subsection (a) of this section must be made without unreasonable delay but not later than 60
days after determination of the breach of security, except in the following situations:
(1) A shorter time is required under federal law.
(2) A law-enforcement agency determines that the notice will impede a criminal investigation and such law-
enforcement agency has made a request of the person that the notice be delayed. Any such delayed notice must be
made after such law-enforcement agency determines that notice will not compromise the criminal investigation and so
notifies the person of such determination.
(3) When a person otherwise required by subsection (a) of this section to provide notice, could not, through
reasonable diligence, identify within 60 days that the personal information of certain residents of this State was
included in a breach of security, such person must provide the notice required by subsection (a) of this section to such
residents as soon as practicable after the determination that the breach of security included the personal information of
such residents, and must provide notice of the breach of security to the Attorney General within 60 days after the
determination of the breach of security, unless such person provides or has provided substitute notice in accordance
with § 12B-101(5)d. of this title. title within 60 days after the determination of the breach of security.
§ 12B-103. Procedures deemed in compliance with security breach notice requirements.
(b) Under this chapter, a person that is regulated by state or federal law, including the Health Insurance Portability
and Accountability Act of 1996 (P.L. 104-191, as amended) and the Gramm Leach Bliley Act (15 U.S.C. § 6801 et seq., as
amended) and that maintains procedures for a breach of security pursuant to the laws, rules, regulations, guidance, or
guidelines established by its primary or functional state or federal regulator is deemed to be in compliance with this chapter
§ 12B-102(c) of this title if the person notifies affected Delaware residents in accordance with the maintained procedures
when a breach of security occurs.
SYNOPSIS
This Act amends Chapter 12B of Title 6 relating to Computer Security Breaches to clarify when businesses must
provide notice of a computer security breach to the Attorney General.
