Comprehensive state privacy law
Rhode Island privacy law
Rhode Island Data Transparency and Privacy Protection Act
Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026
- Citation
- R.I. Gen. Laws §§ 6-48.1-1 to 6-48.1-10
- Enacted
- June 28, 2024. P.L. 2024, ch. 430 (S 2500 Sub A, enacted 28 June 2024) and P.L. 2024, ch. 453 (H 7787 Sub A, enacted 29 June 2024), identical companion acts
- In force
- January 1, 2026
- Effective dates
- January 1, 2026: whole chapter (both public laws, Section 3)
- January 1, 2026: data protection assessments apply only to processing activities created or generated after this date (§ 6-48.1-7(i))
- Enforcer
- Attorney General (sole enforcement authority)
- Private right of action
- No. The chapter expressly bars any private right of action to enforce it (§ 6-48.1-8(c)).
- Cure period
- The chapter contains no notice-and-cure period. The Attorney General may act at once under § 6-48.1-8 or the Deceptive Trade Practices Act (chapter 13.1 of title 6). (§ 6-48.1-8)
- Rulemaking
- No. The chapter grants no rulemaking power.
Amendments
No amendments recorded.
Topics
- ApplicabilityThe Act has two layers. Any commercial website or internet service provider doing business in Rhode Island or with its residents must designate a controller and, if it sells personally identifiable information, post specific notices, with no size threshold. The rights, consent, assessment and processor duties apply only to for-profit entities that in the preceding calendar year handled personal data of at least 35,000 Rhode Island customers (excluding payment-only data), or of at least 10,000 customers while earning more than 20% of gross revenue from selling personal data. Government bodies, nonprofits, higher education, GLBA financial institutions and HIPAA covered entities and business associates are excluded at entity level, and many data types are exempt.
- Consumer rightsCustomers of covered for-profit entities may confirm and access their data, correct it, delete it, obtain a portable copy, and opt out of targeted advertising, sale and profiling for solely automated decisions with legal or similarly significant effects. Controllers must answer within 45 days, extendable once by 45 days with notice. Refusals must be appealable, with a written answer within 60 days, and a customer whose appeal is denied may complain to the Attorney General. An authorized agent may be used only for opt-out requests.
- Sensitive dataCovered controllers may not process sensitive data without the customer's consent. Sensitive data covers racial or ethnic origin, religious beliefs, mental or physical health condition or diagnosis, sex life, sexual orientation, citizenship or immigration status, genetic or biometric data used to identify a person, data collected from a known child, and precise geolocation within 1,750 feet. Data of a known child (under 13, as in COPPA) needs consent and COPPA-compliant processing, and consent must be revocable, with processing stopped within 15 days of revocation.
- Controller dutiesEvery commercial website or internet service provider that collects, stores and sells customers' personally identifiable information must list in its customer agreement or a conspicuous place the categories of personal data it collects, all third parties to which it has sold or may sell that information, and an active email address or online contact. Controllers that sell data or use it for targeted advertising must disclose this clearly. Covered for-profit controllers must keep reasonable security and document data protection assessments for targeted advertising, sales, risky profiling and sensitive data. The chapter has no general data minimisation duty and no duty to honour universal opt-out signals.
- ProcessorsProcessors must follow the controller's instructions and help it meet its obligations. A binding contract must set out processing instructions, the nature and purpose of processing, the data types, the duration, and both parties' rights and obligations. It must also require confidentiality, deletion or return at the end of services, information to show compliance, subcontracting only after the controller can object and under a written contract, and cooperation with assessments.
- EnforcementThe Attorney General has sole enforcement authority and no private right of action exists. A violation is a deceptive trade practice under chapter 13.1 of title 6, which carries a civil penalty of up to $10,000 per violation. Separately, anyone who intentionally discloses personal data to a shell company formed to evade the Act, or in violation of the Act, faces a fine of $100 to $500 per disclosure. There is no cure period.
Sources
Law as of October 28, 2026.
Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.
Official text of the Rhode Island statute
Reference material, not legal advice.