A provision in Delaware's new privacy law could pull thousands of small auto service shops into expensive compliance requirements starting next year.
Most Delaware auto service owners haven't heard of HB380—the state's new personal data privacy law—and fewer still realize it may apply to them. But a buried provision in the bill significantly lowers the threshold that triggers full compliance obligations, potentially affecting far more small shops than the original law intended.
HB380, formally titled "An Act To Amend Title 6 Of The Delaware Code Relating To Personal Data Privacy," rewrote Delaware's privacy rules. The key change for auto services is in § 12D-103(a)(1): the bill lowered the applicability threshold from 35,000 consumers to just 10,000 consumers. There's also a revenue-based threshold that dropped from 10,000 to 5,000 consumers.
That matters because once a business crosses either threshold, it must comply with the law's full requirements—not just a simple privacy notice, but a comprehensive compliance regime.
If your shop falls under the new thresholds, HB380 requires you to:
These aren't one-time tasks. They're ongoing obligations, and compliance costs money—for legal review, policy development, systems updates, and staff time.
The 10,000-consumer threshold sounds high until you think about what "consumers" means under the law. It includes every customer whose personal data your shop collects or processes—not just active customers, but anyone who's ever submitted a repair request, paid an invoice, or provided contact information.
For a multi-location shop, a busy independent garage with a long customer history, or any service that processes payment cards or collects phone numbers and emails, hitting 10,000 records over time is realistic.
The 5,000-consumer revenue threshold is even broader: if your shop generates revenue from personal data (for example, by sharing customer information with vendors or insurers), that lower bar applies.
The compliance obligations become effective January 1, 2027 (Section 2 of HB380). That gives shops roughly two years to understand whether they're subject to the law and, if so, to build compliant systems and policies.
Two years sounds like plenty of time, but compliance projects often take longer than expected—especially for small businesses juggling daily operations.
If you operate an auto service in Delaware, audit your customer data practices now. How many customer records do you maintain? What personal information do you collect and store? Do you share data with third parties? The answers will tell you whether the new thresholds apply to your business.
If you're likely to be covered, start planning compliance steps early. Waiting until late 2026 to address this will be costly and stressful.
For a detailed, business-specific guide to HB380's requirements and compliance timeline, contact your local Delaware business association or attorney.