On July 1, 2014, the Governor of Delaware signed H.B. 295 into law. Subject to certain exemptions for regulated entities, the law requires commercial entities that conduct business in Delaware to take reasonable steps to destroy their consumers' personal identifying information (PII) before disposing of electronic or paper business records containing the PII. The statute provides that consumers' PII must be shredded, erased, or otherwise destroyed or modified so that the PII is entirely unreadable or indecipherable.

Under the law, PII means a consumer's first name or first initial and last name together with certain data elements relating to the consumer (for example, credit card number) when either the name or data elements are unencrypted.

The law provides consumers who sustain damages with a private right of action and the ability to seek treble damages. The Attorney General may also enforce the law in certain circumstances.

This law will be effective January 1, 2015.