At a glance
- Breach notice to residents
- 60 days at most
- State regulator notice
- Attorney General
- State consumer privacy law
- Delaware Personal Data Privacy Act
- Dealer bond
- None
On this page
Federal rules every dealer follows
These apply in every state. Each links to a free tool or guide.
- FTC Safeguards Rule (16 CFR Part 314): a written security plan, a Qualified Individual, a risk assessment, MFA, encryption and the FTC breach notice. Safeguards checklist.
- Red Flags Rule (16 CFR 681): a written identity theft program; most dealers who arrange financing treat themselves as covered. Red Flags program.
- Privacy notice (Gramm-Leach-Bliley Act): give it to buyers who finance or lease. GLBA privacy notice.
- OFAC: never sell to someone on the Treasury's sanctions lists; keep records 10 years. Free OFAC search.
- Form 8300: report cash over $10,000 within 15 days. Form 8300 worksheet.
- Credit notices: adverse action within 30 days, and risk-based pricing notices. Adverse action notice.
- Used Car Rule: the Buyers Guide on every used car for sale. Buyers Guide.
- Advertised prices: include doc fees and other required fees, per the FTC's September 2026 FAQs. Ad and price check.
Delaware's data breach notice law
Delaware's breach notice law is Del. Code Ann. tit. 6, § 12B-102. If personal information of Delaware residents is breached, it says to notify them without unreasonable delay but not later than 60 days after determination of the breach of security (unless federal law requires a shorter time, or law enforcement requests delay).
Who else to tell: the Attorney General. If more than 500 Delaware residents are to be notified; not later than the time notice is provided to residents.
The law has a clause for businesses that follow the breach rules of their own federal regulator (Del. Code Ann. tit. 6, § 12B-103(b) (person regulated by state or federal law, including HIPAA and GLBA, that maintains breach procedures under its primary or functional regulator's rules is deemed in compliance with § 12B-102(c) if it notifies affected residents under those procedures)). Some clauses like this cover only banks and credit unions, so don't count on it: plan to meet the state deadline as well as the FTC's.
The law reads: "Notice required by subsection (a) of this section must be made without unreasonable delay but not later than 60 days after determination of the breach of security"
This is on top of the federal rule. Under the FTC Safeguards Rule, a dealer must tell the FTC within 30 days of discovering a breach of unencrypted information about 500 or more consumers. How the FTC notice works.
Delaware's consumer privacy law
Yes. The Delaware Personal Data Privacy Act (Del. Code Ann. tit. 6, § 12D-101 et seq.) has applied since January 1, 2025.
Who it covers: Persons that conduct business in Delaware or target products/services to Delaware residents and in the preceding calendar year controlled or processed personal data of 35,000+ consumers (excluding payment-only data), or of 10,000+ consumers while deriving more than 20% of gross revenue from selling personal data. From 2027-01-01 (85 Del. Laws c. 463): 10,000+ consumers, or 5,000+ consumers and more than 20% of gross revenue from sales, plus third parties that acquire personal data from a controller.
The law exempts both financial institutions subject to the Gramm-Leach-Bliley Act and the data that act covers. A dealer that arranges financing or leases is generally treated as one, so ask your attorney whether that covers your store. (Del. Code Ann. tit. 6, § 12D-103(b)(2) (financial institutions/affiliates subject to GLBA Title V) and § 12D-103(c)(14) (data subject to GLBA Title V); in the version effective 2027-01-01, (b)(2) no longer covers GLBA financial institutions (only insurers and similar) and only the data-level exemption (c)(14) remains)
The law reads: "(1) Controlled or processed the personal data of not less than 35,000 consumers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction."
Whether your store is covered depends on your own numbers, so check them each year, and keep giving financing buyers the federal privacy notice. Make a free GLBA privacy notice.
Delaware dealer license and bond
A Delaware retail dealer license calls for no surety bond; other amounts apply to some license types or sales volumes. Everything about the Delaware dealer license: who needs one, the lot rules and the application.
Delaware dealer compliance checklist
Write and sign your security plan
Name your Qualified Individual, do the risk assessment and turn on MFA for every system with customer data.
Adopt a Red Flags program
Check the buyer's ID on every deal and log what you checked.
Give the privacy notice
To every buyer who finances or leases, at or before signing.
Check every buyer against the OFAC lists
Keep the dated result in the deal jacket for 10 years.
Track cash
Add up related cash payments and file Form 8300 when they pass $10,000.
Train your staff on security
The Safeguards Rule asks for security awareness training for everyone who handles customer data. Keep a record of who finished it.
Put Delaware's breach deadline in your incident plan
60 days for residents, plus the Attorney General, and the FTC within 30 days at 500 or more consumers.
Check your ads
Advertised prices include doc fees and every fee all buyers pay.
Rules checked and limits
Rules checked October 31, 2026. We read every rule on this page in the eCFR or on the agency's own site, and each is linked in the sources below. We re-check them every quarter.
Delaware laws checked October 31, 2026 on the official sources linked below.
Templates and tools, not legal advice. CarShots is software, not a law firm. For a question about your own dealership, ask your attorney or your state dealer association.