DPO SchoolDPO School

Rhode Island Data Transparency and Privacy Protection Act

Rhode Island privacy law (RIDTPPA): applicability

Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026

Summary (not the statute text)

The Act has two layers. Any commercial website or internet service provider doing business in Rhode Island or with its residents must designate a controller and, if it sells personally identifiable information, post specific notices, with no size threshold. The rights, consent, assessment and processor duties apply only to for-profit entities that in the preceding calendar year handled personal data of at least 35,000 Rhode Island customers (excluding payment-only data), or of at least 10,000 customers while earning more than 20% of gross revenue from selling personal data. Government bodies, nonprofits, higher education, GLBA financial institutions and HIPAA covered entities and business associates are excluded at entity level, and many data types are exempt.

Key points

  1. Notice duties for commercial websites and internet service providers apply without any customer or revenue threshold.

    Section: § 6-48.1-3(a)

  2. Main threshold: personal data of 35,000 or more customers in the preceding calendar year, not counting data used only to complete a payment.

    Section: § 6-48.1-4(a)(1)

  3. Data-seller threshold: 10,000 or more customers and more than 20% of gross revenue from selling personal data.

    Section: § 6-48.1-4(a)(2)

  4. Only for-profit entities are covered by the rights and duties sections; nonprofits and tax-exempt organizations are excluded.

    Section: § 6-48.1-3(d); § 6-48.1-10(c)

  5. Entity-level exclusions for state and local government, higher education, registered national securities associations, GLBA financial institutions (and their affiliates) and HIPAA covered entities and business associates.

    Section: § 6-48.1-3(d); § 6-48.1-10(a)

  6. Contractors and agents of a state agency or local government are excluded when working for it.

    Section: § 6-48.1-10(b)

  7. 'Customer' means a Rhode Island resident acting in an individual or household context; employee and business-to-business contexts are excluded, and employment, emergency-contact and benefits data are exempt.

    Section: § 6-48.1-2(10); § 6-48.1-3(e)(15)

  8. Data-level exemptions include HIPAA protected health information, research data, FCRA-regulated activity, DPPA, FERPA and Farm Credit Act data.

    Section: § 6-48.1-3(e)

Sources

Compare applicability across all states

Law as of October 28, 2026.

Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.

Official text of the Rhode Island statute

Reference material, not legal advice.