DPO SchoolDPO School

Rhode Island Data Transparency and Privacy Protection Act

Rhode Island privacy law (RIDTPPA): consumer rights

Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026

Summary (not the statute text)

Customers of covered for-profit entities may confirm and access their data, correct it, delete it, obtain a portable copy, and opt out of targeted advertising, sale and profiling for solely automated decisions with legal or similarly significant effects. Controllers must answer within 45 days, extendable once by 45 days with notice. Refusals must be appealable, with a written answer within 60 days, and a customer whose appeal is denied may complain to the Attorney General. An authorized agent may be used only for opt-out requests.

Key points

  1. Rights to confirm and access, correct, delete and obtain a portable copy, subject to trade-secret limits.

    Section: § 6-48.1-5(e)(1) to (3)

  2. Right to opt out of targeted advertising, sale of personal data and profiling in furtherance of solely automated decisions with legal or similarly significant effects.

    Section: § 6-48.1-5(e)(4)

  3. Response within 45 days; one extension of 45 days if the customer is told within the first period.

    Section: § 6-48.1-6(b)(1)

  4. Free once per customer in any 12-month period; a fee or refusal is allowed for manifestly unfounded, excessive or repetitive requests.

    Section: § 6-48.1-6(b)(3)

  5. Appeal process required; written decision within 60 days of the appeal; if denied, the customer may complain to the Attorney General.

    Section: § 6-48.1-6(b)(6)

  6. Opt-out requests need no authentication, but may be refused on a documented belief of fraud, with notice to the requester.

    Section: § 6-48.1-6(b)(4)

  7. An authorized agent may act only to opt out, and the controller must be able to verify the customer and the agent's authority.

    Section: § 6-48.1-5(f); § 6-48.1-6(b)(7)

  8. No discrimination for exercising rights, but bona fide loyalty and similar programs may offer different prices.

    Section: § 6-48.1-5(b) to (d)

Sources

Compare consumer rights across all states

Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

Law as of October 28, 2026.

Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.

Official text of the Rhode Island statute

Reference material, not legal advice.