--- title: "Rhode Island privacy law (RIDTPPA): overview" canonical: "https://dposchool.com/state-privacy-laws/state/rhode-island" source: "https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/INDEX.htm" text_as_of: "2026-10-28" last_reviewed: "2026-10-29" language: "en-US" publisher: "DPO School" --- Comprehensive state privacy law # Rhode Island privacy law Rhode Island Data Transparency and Privacy Protection Act Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review) - **Citation:** R.I. Gen. Laws §§ 6-48.1-1 to 6-48.1-10 - **Official text:** https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/INDEX.htm - **Enacted:** June 28, 2024. [P.L. 2024, ch. 430 (S 2500 Sub A, enacted 28 June 2024) and P.L. 2024, ch. 453 (H 7787 Sub A, enacted 29 June 2024), identical companion acts](https://webserver.rilegislature.gov/PublicLaws/law24/law24430.htm) - **In force:** January 1, 2026 - **Effective dates:** - **January 1, 2026:** whole chapter (both public laws, Section 3) - **January 1, 2026:** data protection assessments apply only to processing activities created or generated after this date (§ 6-48.1-7(i)) - **Enforcer:** Attorney General (sole enforcement authority) - **Private right of action:** No. The chapter expressly bars any private right of action to enforce it (§ 6-48.1-8(c)). - **Cure period:** The chapter contains no notice-and-cure period. The Attorney General may act at once under § 6-48.1-8 or the Deceptive Trade Practices Act (chapter 13.1 of title 6). (§ 6-48.1-8) - **Rulemaking:** No. The chapter grants no rulemaking power. ## Amendments No amendments recorded. ## Topics - [Applicability](https://dposchool.com/state-privacy-laws/state/rhode-island/applicability): The Act has two layers. Any commercial website or internet service provider doing business in Rhode Island or with its residents must designate a controller and, if it sells personally identifiable information, post specific notices, with no size threshold. The rights, consent, assessment and processor duties apply only to for-profit entities that in the preceding calendar year handled personal data of at least 35,000 Rhode Island customers (excluding payment-only data), or of at least 10,000 customers while earning more than 20% of gross revenue from selling personal data. Government bodies, nonprofits, higher education, GLBA financial institutions and HIPAA covered entities and business associates are excluded at entity level, and many data types are exempt. - [Consumer rights](https://dposchool.com/state-privacy-laws/state/rhode-island/consumer-rights): Customers of covered for-profit entities may confirm and access their data, correct it, delete it, obtain a portable copy, and opt out of targeted advertising, sale and profiling for solely automated decisions with legal or similarly significant effects. Controllers must answer within 45 days, extendable once by 45 days with notice. Refusals must be appealable, with a written answer within 60 days, and a customer whose appeal is denied may complain to the Attorney General. An authorized agent may be used only for opt-out requests. - [Sensitive data](https://dposchool.com/state-privacy-laws/state/rhode-island/sensitive-data): Covered controllers may not process sensitive data without the customer's consent. Sensitive data covers racial or ethnic origin, religious beliefs, mental or physical health condition or diagnosis, sex life, sexual orientation, citizenship or immigration status, genetic or biometric data used to identify a person, data collected from a known child, and precise geolocation within 1,750 feet. Data of a known child (under 13, as in COPPA) needs consent and COPPA-compliant processing, and consent must be revocable, with processing stopped within 15 days of revocation. - [Controller duties](https://dposchool.com/state-privacy-laws/state/rhode-island/controller-duties): Every commercial website or internet service provider that collects, stores and sells customers' personally identifiable information must list in its customer agreement or a conspicuous place the categories of personal data it collects, all third parties to which it has sold or may sell that information, and an active email address or online contact. Controllers that sell data or use it for targeted advertising must disclose this clearly. Covered for-profit controllers must keep reasonable security and document data protection assessments for targeted advertising, sales, risky profiling and sensitive data. The chapter has no general data minimisation duty and no duty to honour universal opt-out signals. - [Processors](https://dposchool.com/state-privacy-laws/state/rhode-island/processors): Processors must follow the controller's instructions and help it meet its obligations. A binding contract must set out processing instructions, the nature and purpose of processing, the data types, the duration, and both parties' rights and obligations. It must also require confidentiality, deletion or return at the end of services, information to show compliance, subcontracting only after the controller can object and under a written contract, and cooperation with assessments. - [Enforcement](https://dposchool.com/state-privacy-laws/state/rhode-island/enforcement): The Attorney General has sole enforcement authority and no private right of action exists. A violation is a deceptive trade practice under chapter 13.1 of title 6, which carries a civil penalty of up to $10,000 per violation. Separately, anyone who intentionally discloses personal data to a shell company formed to evade the Act, or in violation of the Act, faces a fine of $100 to $500 per disclosure. There is no cure period. ## Sources - [R.I. Gen. Laws chapter 6-48.1 (index and sections 6-48.1-1 to 6-48.1-10)](https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/INDEX.htm) - [P.L. 2024, ch. 430 (S 2500 Sub A as amended)](https://webserver.rilegislature.gov/PublicLaws/law24/law24430.htm) - [P.L. 2024, ch. 453 (H 7787 Sub A as amended)](https://webserver.rilegislature.gov/PublicLaws/law24/law24453.htm) - [R.I. Gen. Laws § 6-13.1-8 (Deceptive Trade Practices Act civil penalties)](https://webserver.rilegislature.gov/Statutes/TITLE6/6-13.1/6-13.1-8.htm) ## Status Law as of October 28, 2026. [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed. [Official text of the Rhode Island statute](https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/INDEX.htm) Reference material, not legal advice. ## Navigation [US State Privacy Laws](https://dposchool.com/state-privacy-laws) / Rhode Island Previous: [Kentucky](https://dposchool.com/state-privacy-laws/state/kentucky) Next: [Louisiana](https://dposchool.com/state-privacy-laws/state/louisiana) Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com). ## For AI agents - Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt - JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents