Data Privacy Interactive Map - Rhode Island

Highlights

Covered Entities: A municipal or state agency, individual, sole proprietorship, partnership, association, corporation, joint venture, business, legal entity, trust, estate, cooperative, or other commercial entity that stores, owns, collects, processes, maintains, acquires, uses, or licenses data that includes personal information.

Consumer Notification: Notification must be provided to Rhode Island residents whose personal information is disclosed or pursuant to a “breach” that poses a significant risk of identity theft or is reasonably believed to have been acquired without authorization.

Regulatory Notification: Notification must be made to the Rhode Island Attorney General if more than 500 Rhode Island residents are notified.

Notification Timeline: Notification must be made “in the most expedient time possible, but no later than 45 calendar days” following confirmation of a “breach” and the ability to ascertain information necessary to provide notification.

Data Format: Electronic and hard copy (paper)

Citations: R.I. Gen. Law §§ 11-49.3-1 to 11-49.3-6

More Details

Definitions:

• Breach: Unauthorized access or acquisition of unencrypted, computerized data that compromises the security, confidentiality, or integrity of personal information.
• Personal information (PI): An individual’s first name / first initial and last name in combination with any of the following data elements:
  • Social Security number;
  • Driver’s license, state identification card number, or tribal identification number;
  • Financial account or payment card number plus any security code, access code, password, or personal identification number that would permit access to a financial account;
  • Medical or health insurance information; or
  • E-mail address plus a security code, access code, or password that would permit access to a personal, medical, insurance, or financial account.
• Medical Information: Any information regarding an individual’s medical history, mental or physical condition, or medical treatment or diagnosis.
• Health Insurance Information: An individual’s health insurance policy number, subscriber identification number, or any unique identifier used by a health insurer to identify the individual.

Safe Harbors:

• Encryption: Notification is not required where the potentially impacted PI is encrypted, so long as the encryption key, security code, or password was not also acquired that would permit access to the data.
• Good Faith: Notification is not required where the potentially impacted PI was acquired in good faith by an employee or agent for the purposes of the agency, so long as the PI is not used or subject to further unauthorized disclosure.
• Risk of Harm: Notification is not required if the “breach” does not pose a significant risk of identity theft.
• Law Enforcement Delay: Notification may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation.
• Public Record: N/A

Direct Notice:

• Timing: Notification must be made in the most expedient time possible, but no later than 30 calendar days for state and municipal agencies and 45 calendar days for other entities following confirmation of a “breach” and the ability to ascertain information necessary to provide notification.
• Format: N/A
• Content: Notification must include:
  • A general description of the breach incident and the number of affected individuals;
  • Types of PI that were impacted
  • Estimated date/date range of the breach;
  • Date of discovery of the breach;
  • A clear and concise description of any remediation services offered, including toll-free numbers and websites to contact (i) credit reporting agencies; (ii) remediation services providers; and (iii) the Rhode Island Attorney General; and
  • A clear and concise description of the individual’s ability to file a police report; how an individual may request a credit freeze and the information necessary to request a credit freeze; and that fees may be required to be paid to the consumer reporting agencies
• Method: Notification may be provided by (1) written notice; (2) electronic notice, if consistent with the provisions regarding electronic records and signatures in 15 U.S. Code § 7001; or (3) substitute notice.

Substitute Notice:

An entity may provide substitute notice if the entity demonstrates (1) the cost of direct notice would exceed $25,000; (2) the notification population exceeds 50,000; or (3) the entity does not have sufficient contact information. It must consist of (1) e-mail notice, where an email address is available; (2) conspicuous posting on the entity’s webpage; and (3) notice to major statewide media.

Remediation Services:

N/A

Regulatory Notice:

Notification must be made to the Rhode Island Attorney General if more than 500 Rhode Island residents are notified.

Credit Reporting Agencies Notice:

Notification must be made to the major consumer reporting agencies if more than 500 Rhode Island residents are notified.

Third-Party Notice:

N/A

HIPAA:

A provider of health care, health care service plan, health insurer, or covered entity governed by the medical privacy and security rules issued by the Federal Department of Health and Human Services, Parts 160 and 164 of Title 45 of the Code of Federal Regulations, established pursuant to the Health Insurance Portability and Accountability Act of 1996 (HIPPA) will be deemed in compliance with this chapter.

Private Action:

N/A

Associated Regulations:

• Information Security Standard (R.I. Gen Laws §§ 11-49.3-2 – 11-49.3-6)

Highlights

Covered Entities: A municipal agency, state agency, or person that stores, collects, processes, maintains, acquires, uses, owns, or licenses personal information about a Rhode Island resident

First Party Security Standard: A municipal agency, state agency, or entity that stores, collects, processes, maintains, acquires, uses, owns, or licenses personal information about a Rhode Island resident shall implement and maintain a risk-based information security program that contains reasonable security procedures and practices appropriate to the size and scope of the organization; the nature of the information; and the purpose for which the information was collected in order to protect the personal information from unauthorized access, use, modification, destruction, or disclosure and to preserve the confidentiality, integrity, and availability of such information.

Third Party Security Standard: A municipal agency, state agency, or entity that discloses personal information about a Rhode Island resident to a nonaffiliated third party shall require by written contract that the third party implement and maintain reasonable security procedures and practices appropriate to the size and scope of the organization; the nature of the information; and the purpose for which the information was collected in order to protect the personal information from unauthorized access, use, modification, destruction, or disclosure. The provisions of this section shall apply to contracts entered into after the effective date of this act (2016).

Disposal/Destruction Standard: A municipal agency, state agency, or entity shall not retain personal information for a period longer than is reasonably required to provide the services requested; to meet the purpose for which it was collected; or in accordance with a written retention policy or as may be required by law. A municipal agency, state agency, or person shall destroy all personal information, regardless of the medium that such information is in, in a secure manner, including, but not limited to, shredding, pulverization, incineration, or erasure.

Data Format: Electronic and Paper.

Citations: R.I. Gen Laws §§ 11-49.3-2 – 11-49.3-6

More Details

Definitions:

• Municipal Agency: Any department, division, agency, commission, board, office, bureau, authority, quasi-public authority, or school, fire, or water district within Rhode Island, other than a state agency, and any other agency that is in any branch of municipal government and exercises governmental functions other than in an advisory nature.

• Owner: The original collector of the information.

• Person: Any individual, sole proprietorship, partnership, association, corporation, joint venture, business, legal entity, trust, estate, cooperative, or other commercial entity.

• Personal Information (PI): An individual’s first name or first initial and last name in combination with one (1) or more of the following data elements, when the name and data elements are not encrypted or are in hard copy, paper format:
  
  • Social Security number;
  • Driver’s license number, Rhode Island identification card number, or tribal identification number
  • Account number, credit, or debit card number, in combination with any required security code, access code, password, or personal identification number, that would permit access to an individual’s financial account; or
  • Medical or health insurance information.
  • E-mail address with any required security code, access code, or password that would permit access to an individual’s personal, medical, insurance, or financial account.

• State Agency: Any department, division, agency, commission, board, office, bureau, authority, or quasi-public authority within Rhode Island; either branch of the Rhode Island general assembly or an agency or committee thereof; the judiciary; or any other agency that is in any branch of Rhode Island state government and that exercises governmental functions other than in an advisory nature.

Methods of Compliance:

Implement and maintain a risk-based information security program that contains reasonable security procedures and practices appropriate to the size and scope of the organization; the nature of the information; and the purpose for which the information was collected. This includes reasonable retention and disposal.

Exclusions:

• Health Care: A provider of health care, healthcare service plan, health insurer, or a covered entity governed by the medical privacy and security rules issued by the federal Department of Health and Human Services, Parts 160 and 164 of Title 45 of the Code of Federal Regulations, established pursuant to the Health Insurance Portability and Accountability Act of 1996 (HIPAA) shall be deemed in compliance Rhode Island law on information security.
• Financial: A financial institution, trust company, credit union, or its affiliates that is subject to and examined for, and found in compliance with, the Federal Interagency Guidelines on Response Programs for Unauthorized Access to Customer Information and Customer Notice shall be deemed in compliance with Rhode Island law on information security.
• Other: N/A

Enforcement/Penalties:

Whenever the attorney general has reason to believe that a violation of this chapter has occurred and that proceedings would be in the public interest, the attorney general may bring an action in the name of the state against the business or person in violation. Each reckless violation of this chapter is a civil violation for which a penalty of not more than $100 per record may be adjudged against a defendant. Each knowing and willful violation of this chapter is a civil violation for which a penalty of not more than $200 per record may be adjudged against a defendant.

Associated Regulations:

N/A

Rhode Island Data Transparency and Privacy Protection Act 

RI H 7787, S2500

Highlights

Applicability:

The RIDTPPA applies to:

For-profit entities that conduct business in Rhode Island or produce products or services targeted to residents of Rhode Island and that during the proceeding calendar year:

• Controlled or Processed the Personal Data of at least 35,000 Rhode Island Customers, excluding Personal Data controlled or Processed solely for the purpose of completing a payment transaction; or
• Controlled or Processed the Personal Data of at least 10,000 Rhode Island Customers and derived more than 20 percent of gross revenue from the Sale of the Personal Data.

Commercial websites or Internet service providers that conduct business in Rhode Island, with Customers in Rhode Island, or otherwise are subject to Rhode Island jurisdiction. Such commercial websites or Internet service providers are required to designate a Controller.

Among other exclusions, the RIDTPPA does not apply to state or local government entities; nonprofit organizations; institutions of higher education; financial institutions and related financial data subject to the Gramm-Leach-Bliley Act; national securities associations registered under the Securities Exchange Act; protected health information and use under the Health Insurance Portability and Accountability Act (HIPAA); certain employment-related data; consumer credit-related data as regulated under the Fair Credit Reporting Act; and certain data regulated under other federal laws, including the Driver's Privacy Protection Act, the Family Educational Rights and Privacy Act; the Farm Credit Act; and the Airline Deregulation Act.

Controller Obligations:

Among other obligations, the RIDTPPA requires Controllers to:

• Establish, implement, and maintain reasonable administrative, technical, and physical data security practices to protect the confidentiality, integrity and accessibility of Personal Data.
• Not Process Sensitive Data concerning a Customer without obtaining Customer consent and not Process Sensitive Data of a known child, unless consent is obtained, and the information is Processed in accordance with COPPA. Controllers and Processors that comply with the verifiable parental consent requirements under COPPA will be deemed compliant.
• Not Process Personal Data in violation of the laws of the State and federal laws that prohibit unlawful discrimination against Customers.
• Provide Customers with a mechanism to grant and revoke consent where consent is required. Upon receipt of revocation, the Controller must suspend the Processing of data as soon as is practicable. The Controller must effectuate the revocation no longer than fifteen (15) days from receipt of the request.
• Not discriminate against a Customer for exercising Customer rights. Controllers may, however, provide different prices and levels for goods and services if data collection is for a bona fide loyalty, rewards, premium features, discount or club card programs that Customers voluntarily participate.
• Conduct and document a data protection assessment for each of the Controller's Processing activities that presents a heightened risk of harm to a Customer, including the following:
  • Processing of Personal Data for the purposes of Targeted Advertising;
  • Sale of Personal Data;
  • Processing of Personal Data for the purposes of Profiling that presents a reasonably foreseeable risk of unfair or deceptive treatment of, or unlawful disparate impact on, Customers, financial, physical or reputational injury to Customers, a physical or other intrusion upon the solitude or seclusion, or the private affairs or concerns, of Customers;
  • Processing of Sensitive Data.
• Respond to a Customer without undue delay, but not later than forty-five (45) days after receipt of the request. The Controller may extend the response period by forty-five (45) additional days when reasonably necessary, considering the complexity and number of the Customer's requests, provided the Controller informs the Customer of the extension within the initial forty-five (45) day response period and of the reason for the extension. 
• If a Controller declines to act regarding the Customer's request, inform the Customer without undue delay, but not later than forty-five (45) days after receipt of the request, of the justification for declining to act and instructions for how to appeal the decision.
• Provide Information in response to a Customer request, free of charge, once per Customer during any twelve (12) month period. If requests from a Customer are manifestly unfounded, excessive, or repetitive, the Controller may charge the Customer a reasonable fee to cover the administrative costs of complying with the request or decline to act on the request. The Controller bears the burden of demonstrating the manifestly unfounded, excessive, or repetitive nature of the request.
• If a Controller is unable to authenticate a Customer request, the Controller is not required to comply with the request and must provide notice to the Customer that the Controller is unable to authenticate the request to exercise such right or rights until the Customer provides additional information reasonably necessary to authenticate the request.
• A Controller is not required to authenticate an opt-out request if the Controller has reasonable and documented belief that such request is fraudulent. If a Controller accordingly denies an opt-out request, the Controller just send notice to the requester disclosing that the Controller believes such request is fraudulent, why the Controller believes the request is fraudulent, and that the Controller will not comply with the request.
• Establish a process, clearly and conspicuously available, for a Customer to appeal the Controller's refusal to take action on a request. Not later than sixty (60) days after receipt of an appeal, a Controller must inform the Customer in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decision.

Commercial websites or Internet service providers: If a commercial website or Internet service provider collects, stores, and sells Customers' personally identifiable information,¹ its designated Controller must, in the Controller’s Customer agreement or included in a conspicuous location on the Controller’s website or online service platform where similar notices are posted:

• Identify all categories of Personal Data the Controller collects through the website or online service about Customers;
• Identify all third parties to whom the Controller has sold or may sell Customers' personally identifiable information; and
• Identify an active electronic mail address or other online mechanism the Customer may use to contact the Controller.
• If a Controller sells Personal Data to third parties or Processes Personal Data for Targeted Advertising, clearly and conspicuously disclose such Processing.

Processor Obligations:

Among other obligations, the RIDTPPA requires Processors to:

• Adhere to the instructions of, and assist the Controller in, complying with the Controller’s obligations.
• Enter into a binding contract with the Controller, governing the Processor’s Data Processing procedures and setting forth instructions for Processing data, the nature and purpose of Processing, the type of data subject to Processing, the duration of Processing, and the rights and obligations of both parties. The contract must include the requirement that a Processor ensure that: each person Processing Personal Data is subject to a duty of confidentiality; at the Controller's direction, each person delete or return all Personal Data to the Controller, unless otherwise required by law; and upon the reasonable request of the Controller, each person make available all information necessary to demonstrate the Processor's compliance with related obligations.
• In the event of engaging a subcontractor, enter into a written contract that requires the subcontractor to meet the obligations of the Processor with respect to Personal Data.
• Allow, and cooperate with, reasonable assessments regarding the Processor's policies and technical and organizational measures. The Processor shall provide a report of such assessment to the Controller, upon request.

Customer Rights:

Under the RIDTPPA, a Customer has a right to the exercise the following, by secure and reliable means established by the Controller and described in the privacy notice:

• Confirm whether a Controller is Processing and/or accessing the Customer’s Personal Data;
• Correct inaccuracies in the Customer’s Personal Data;
• Delete the Customer’s Personal Data;
• Obtain a Copy of the Customer’s Personal Data held by the Controller in a portable and, to the extent technically feasible, readily usable format;
• Opt out of the Processing of Personal Data for the purposes of Targeted Advertising, the Sale of Persona Data, or Profiling in furtherance of of solely automated decisions that produce legal or similarly significant effects concerning the Customer; and
• Designate another person to serve as the customer's authorized agent and act on customer's behalf, to opt out of the processing of such customer's personal data. A controller shall comply with an opt-out request received from an authorized agent if the controller is able to verify the identity of the customer and the authorized agent's authority to act on the customer's behalf.

More Details

Definitions:

• Biometric Data: Data generated by automatic measurements of an individual's biological characteristics, such as a fingerprint, a voiceprint, eye retinas, irises or other unique biological patterns or characteristics that are used to identify a specific individual. Biometric Data does not include a digital or physical photograph, an audio or video recording, or any data generated from a digital or physical photograph, or an audio or video recording, unless such data is generated to identify a specific individual.
• Child: As defined under COPPA.
• Customer: An individual residing in this state acting in an individual or household context. Customer does not include an individual acting in a commercial or employment context or as an employee, owner, director, officer or contractor of a company, partnership, sole proprietorship, nonprofit or government agency whose communications or transactions with the Controller occur solely within the context of that individual's role with the company, partnership, sole proprietorship, nonprofit or government agency.
• Controller: An individual who, or legal entity that, alone or jointly with others determines the purpose and means of Processing Personal Data.
• Personal Data: Any information that is linked or reasonably linkable to an identified or identifiable individual and does not include de-identified data or publicly available information.
• Process or Processing: Any operation or set of operations performed, whether by manual or automated means, on Personal Data or on sets of Personal Data, such as the collection, use, storage, disclosure, analysis, deletion or modification of Personal Data.
• Processor: An individual who, or legal entity that, Processes Personal Data on behalf of a Controller.
• Profiling: Any form of automated Processing performed on Personal Data to evaluate, analyze or predict personal aspects related to an identified or identifiable individual's economic situation, health, personal preferences, interests, reliability, behavior, location or movements.
• Sale of Personal Data: The exchange of Personal Data for monetary or other valuable consideration by the Controller to a third party. Sale of Personal Data does not include the disclosure of Personal Data to a Processor that Processes the Personal Data on behalf of the Controller, the disclosure of Personal Data to a third party for purposes of providing a product or service requested by the Customer, the disclosure or transfer of Personal Data to an affiliate of the Controller, the disclosure of Personal Data where the Customer directs the Controller to disclose the Personal Data or intentionally uses the Controller to interact with a third party, the disclosure of Personal Data that the Customer: intentionally made available to the general public via a channel of mass media; and did not restrict to a specific audience, or the disclosure or transfer of Personal Data to a third party as an asset that is part of a merger, acquisition, bankruptcy or other transaction, or a proposed merger, acquisition, bankruptcy or other transaction, in which the third party assumes control of all or part of the Controller's assets.
• Sensitive data:​ Personal Data that includes data revealing racial or ethnic origin, religious beliefs, mental or physical health condition or diagnosis, sex life, sexual orientation or citizenship or immigration status, the Processing of genetic or Biometric Data for the purpose of uniquely identifying an individual, Personal Data collected from a known child, or precise geolocation data.
• Targeted Advertising: Displaying advertisements to a Customer where the advertisement is selected based on Personal Data obtained or inferred from that Customer's activities over time and across nonaffiliated Internet websites or online applications to predict such Customer's preferences or interests. Targeted Advertising does not include advertisements based on activities within a Controller's own Internet websites or online applications, advertisements based on the context of a Customer's current search query, or current visit to an Internet website or online application, advertisements directed to a Customer in response to the Customer's request for information or feedback or processing Personal Data solely to measure or report advertising frequency, performance, or reach.

Penalties:

Violations of RIDTPPA are enforced by the Rhode Island Attorney General and constitute violations of Rhode Island's Commercial Law, under which each violation can incur civil penalties of up to $10,000. In the alternative, the Attorney General may bring an action for injunctive relief. Additionally, the Rhode Island Data Privacy Act provides that any individual or entity that intentionally discloses Personal Data may be fined up to $500, but no less than $100, for such disclosures.

Private Action:

No

Enforcement Action:

Civil penalties and injunctive relief

Associated Regulations & Rulemaking:

R.I.G.L. Title 6 (2024)

Notes on AI Related Regulations:

Rhode Island's AI regulations are currently sectoral and issue-specific, concentrating on legal ethics, profiling, automated decision-making, and election-related deepfakes. Broader regulatory frameworks or additional rulemaking may be proposed in the future.

Effective Date:

January 1, 2026

[1] The RIDTPPA does not explicitly define “personally identifiable information”