Even though the DPDPA does not provide guidelines for breach notifications, businesses are still obliged by the breach notification law of Delaware. Under this law, businesses must report security breaches to the person whose personal information was breached within 60 days after discovery. If the security breach affects more than 500 people, businesses must also notify the Attorney General.