DPO SchoolDPO School

Rhode Island Data Transparency and Privacy Protection Act

Rhode Island privacy law (RIDTPPA): controller duties

Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026

Summary (not the statute text)

Every commercial website or internet service provider that collects, stores and sells customers' personally identifiable information must list in its customer agreement or a conspicuous place the categories of personal data it collects, all third parties to which it has sold or may sell that information, and an active email address or online contact. Controllers that sell data or use it for targeted advertising must disclose this clearly. Covered for-profit controllers must keep reasonable security and document data protection assessments for targeted advertising, sales, risky profiling and sensitive data. The chapter has no general data minimisation duty and no duty to honour universal opt-out signals.

Key points

  1. Commercial websites and internet service providers must designate a controller.

    Section: § 6-48.1-3(a)

  2. Sellers of personally identifiable information must identify all categories of data collected, all third parties to which data has been or may be sold (named, not just categories), and an active email or online contact.

    Section: § 6-48.1-3(a)(1) to (3)

  3. Selling personal data or processing it for targeted advertising must be disclosed clearly and conspicuously.

    Section: § 6-48.1-3(b)

  4. Reasonable administrative, technical and physical security practices are required.

    Section: § 6-48.1-4(b)

  5. Documented data protection assessments for targeted advertising, sale, risky profiling and sensitive data; the Attorney General may require their disclosure, and they stay confidential.

    Section: § 6-48.1-7(e), (f)

  6. Processing under the Act's exemptions must be reasonably necessary, proportionate and limited to what is necessary; there is no general minimisation rule for ordinary processing.

    Section: § 6-48.1-7(s)

  7. No provision requires controllers to honour a universal opt-out mechanism or browser signal.

    Section: § 6-48.1-5; § 6-48.1-6

  8. Holders of de-identified data must take reasonable measures, publicly commit not to re-identify and bind recipients by contract.

    Section: § 6-48.1-7(j)

Sources

Compare controller duties across all states

Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

Law as of October 28, 2026.

Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.

Official text of the Rhode Island statute

Reference material, not legal advice.