--- title: "Rhode Island privacy law (RIDTPPA): applicability" canonical: "https://dposchool.com/state-privacy-laws/state/rhode-island/applicability" source: "https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/INDEX.htm" text_as_of: "2026-10-28" last_reviewed: "2026-10-29" language: "en-US" publisher: "DPO School" --- Rhode Island Data Transparency and Privacy Protection Act # Rhode Island privacy law (RIDTPPA): applicability Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review) ## Summary (not the statute text) The Act has two layers. Any commercial website or internet service provider doing business in Rhode Island or with its residents must designate a controller and, if it sells personally identifiable information, post specific notices, with no size threshold. The rights, consent, assessment and processor duties apply only to for-profit entities that in the preceding calendar year handled personal data of at least 35,000 Rhode Island customers (excluding payment-only data), or of at least 10,000 customers while earning more than 20% of gross revenue from selling personal data. Government bodies, nonprofits, higher education, GLBA financial institutions and HIPAA covered entities and business associates are excluded at entity level, and many data types are exempt. ## Key points 1. Notice duties for commercial websites and internet service providers apply without any customer or revenue threshold. Section: [§ 6-48.1-3(a)](https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/INDEX.htm) 2. Main threshold: personal data of 35,000 or more customers in the preceding calendar year, not counting data used only to complete a payment. Section: [§ 6-48.1-4(a)(1)](https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/INDEX.htm) 3. Data-seller threshold: 10,000 or more customers and more than 20% of gross revenue from selling personal data. Section: [§ 6-48.1-4(a)(2)](https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/INDEX.htm) 4. Only for-profit entities are covered by the rights and duties sections; nonprofits and tax-exempt organizations are excluded. Section: [§ 6-48.1-3(d); § 6-48.1-10(c)](https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/INDEX.htm) 5. Entity-level exclusions for state and local government, higher education, registered national securities associations, GLBA financial institutions (and their affiliates) and HIPAA covered entities and business associates. Section: [§ 6-48.1-3(d); § 6-48.1-10(a)](https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/INDEX.htm) 6. Contractors and agents of a state agency or local government are excluded when working for it. Section: [§ 6-48.1-10(b)](https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/INDEX.htm) 7. 'Customer' means a Rhode Island resident acting in an individual or household context; employee and business-to-business contexts are excluded, and employment, emergency-contact and benefits data are exempt. Section: [§ 6-48.1-2(10); § 6-48.1-3(e)(15)](https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/INDEX.htm) 8. Data-level exemptions include HIPAA protected health information, research data, FCRA-regulated activity, DPPA, FERPA and Farm Credit Act data. Section: [§ 6-48.1-3(e)](https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/INDEX.htm) ## Sources - [https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/6-48.1-3.htm](https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/6-48.1-3.htm) - [https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/6-48.1-4.htm](https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/6-48.1-4.htm) - [https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/6-48.1-10.htm](https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/6-48.1-10.htm) [Compare applicability across all states](https://dposchool.com/state-privacy-laws/topic/applicability) ## Status Law as of October 28, 2026. [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed. [Official text of the Rhode Island statute](https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/INDEX.htm) Reference material, not legal advice. ## Other topics for Rhode Island - [Consumer rights](https://dposchool.com/state-privacy-laws/state/rhode-island/consumer-rights) - [Sensitive data](https://dposchool.com/state-privacy-laws/state/rhode-island/sensitive-data) - [Controller duties](https://dposchool.com/state-privacy-laws/state/rhode-island/controller-duties) - [Processors](https://dposchool.com/state-privacy-laws/state/rhode-island/processors) - [Enforcement](https://dposchool.com/state-privacy-laws/state/rhode-island/enforcement) ## Navigation [US State Privacy Laws](https://dposchool.com/state-privacy-laws) / [Rhode Island](https://dposchool.com/state-privacy-laws/state/rhode-island) / Applicability Next: [Consumer rights](https://dposchool.com/state-privacy-laws/state/rhode-island/consumer-rights) Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com). ## For AI agents - Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt - JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents