Delaware’s Insurance Data Security Act: A Growing Trend of Data Privacy and Cyber Security Regulation of the Insurance Industry Banner Image

Cyber Security & Data Privacy

Riker Danzig LLP is one of New Jersey’s oldest and largest law firms. Utilizing their strengths in litigation,...

Delaware’s Insurance Data Security Act: A Growing Trend of Data Privacy and Cyber Security Regulation of the Insurance Industry

August 7, 2019

On July
31, 2019, Delaware Governor John C. Carney, Jr. signed the Insurance Data
Security Act (“IDSA”) into law.  The IDSA establishes a comprehensive
regulatory framework requiring insurers licensed to do business in Delaware to:
i) implement information security programs and risk assessments; ii)
investigate whether a cyber security event or data breach occurred and whose
data may have been compromised; iii) notify the Delaware Insurance Commissioner
within three (3) business days of determining that a cyber security event or
data breach occurred; iv) notify all impacted consumers within sixty (60) days
of the determination that a cyber security event or data breach has occurred,
and data has been or may have been compromised; and v) offer one (1) year of
credit monitoring services to impacted customers.  Lastly, the IDSA grants
the Delaware Insurance Commissioner with the power to investigate any insurer
to determine whether it has engaged in conduct that might violate the IDSA, and
to take remedial action.

Delaware’s Insurance Data Security Act is based on the National
Association of Insurance Commissioners (“NAIC”) Model Law
. Since NAIC’s
promulgation of the Model Law in October of 2017, several other states have
adopted similar laws and regulations including South Carolina, Michigan, Ohio,
and New York.  We expect this trend to continue and foresee states
continuing to adopt the NAIC Model Law.

Amidst the
rising incidence of cyberattacks and growing number of high profile data
breaches, regulators have stepped up their scrutiny of information security
programs.  As the trend continues, insurance companies should confirm that
their information security and data privacy programs are compliant. 

A copy of
Delaware’s IDSA can be found here.  If
you have any questions, please contact one of this Alert's authors: Michael P.
O'Mullan at, Labinot
Alexander Berlajolli at
or Daniel J. Parziale at,
or any other attorney in Riker Danzig’s Cyber Security & Data Privacy

Danzig's Cyber
Security & Data Privacy

E. O’Donnell

Michael P. O’Mullan
Maura C. Smith
P. Moulthrop
J. Schoenberg
J. Kalik
D. Navarino
J. Zarillo, Jr.

Our Team

Jason D. Navarino

Jason D. Navarino

Brian E. O'Donnell

Brian E. O'Donnell

Michael P. O'Mullan

Michael P. O'Mullan

Maura C. Smith

Maura C. Smith

Anthony J. Zarillo, Jr.

Anthony J. Zarillo, Jr.

Samuel P. Moulthrop

Samuel P. Moulthrop
Of Counsel

Robert J. Schoenberg

Robert J. Schoenberg
Of Counsel

Labinot Alexander Berlajolli

Labinot Alexander Berlajolli

Get Our Latest Insights