--- title: "Rhode Island privacy law (RIDTPPA): controller duties" canonical: "https://dposchool.com/state-privacy-laws/state/rhode-island/controller-duties" source: "https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/INDEX.htm" text_as_of: "2026-10-28" last_reviewed: "2026-10-29" language: "en-US" publisher: "DPO School" --- Rhode Island Data Transparency and Privacy Protection Act # Rhode Island privacy law (RIDTPPA): controller duties Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review) ## Summary (not the statute text) Every commercial website or internet service provider that collects, stores and sells customers' personally identifiable information must list in its customer agreement or a conspicuous place the categories of personal data it collects, all third parties to which it has sold or may sell that information, and an active email address or online contact. Controllers that sell data or use it for targeted advertising must disclose this clearly. Covered for-profit controllers must keep reasonable security and document data protection assessments for targeted advertising, sales, risky profiling and sensitive data. The chapter has no general data minimisation duty and no duty to honour universal opt-out signals. ## Key points 1. Commercial websites and internet service providers must designate a controller. Section: [§ 6-48.1-3(a)](https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/INDEX.htm) 2. Sellers of personally identifiable information must identify all categories of data collected, all third parties to which data has been or may be sold (named, not just categories), and an active email or online contact. Section: [§ 6-48.1-3(a)(1) to (3)](https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/INDEX.htm) 3. Selling personal data or processing it for targeted advertising must be disclosed clearly and conspicuously. Section: [§ 6-48.1-3(b)](https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/INDEX.htm) 4. Reasonable administrative, technical and physical security practices are required. Section: [§ 6-48.1-4(b)](https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/INDEX.htm) 5. Documented data protection assessments for targeted advertising, sale, risky profiling and sensitive data; the Attorney General may require their disclosure, and they stay confidential. Section: [§ 6-48.1-7(e), (f)](https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/INDEX.htm) 6. Processing under the Act's exemptions must be reasonably necessary, proportionate and limited to what is necessary; there is no general minimisation rule for ordinary processing. Section: [§ 6-48.1-7(s)](https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/INDEX.htm) 7. No provision requires controllers to honour a universal opt-out mechanism or browser signal. Section: [§ 6-48.1-5; § 6-48.1-6](https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/INDEX.htm) 8. Holders of de-identified data must take reasonable measures, publicly commit not to re-identify and bind recipients by contract. Section: [§ 6-48.1-7(j)](https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/INDEX.htm) ## Sources - [https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/6-48.1-3.htm](https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/6-48.1-3.htm) - [https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/6-48.1-7.htm](https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/6-48.1-7.htm) [Compare controller duties across all states](https://dposchool.com/state-privacy-laws/topic/controller-duties) ## Related GDPR articles Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions. - [Article 35: Data protection impact assessment](https://dposchool.com/gdpr/article/35) (assessments) ## Status Law as of October 28, 2026. [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed. [Official text of the Rhode Island statute](https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/INDEX.htm) Reference material, not legal advice. ## Other topics for Rhode Island - [Applicability](https://dposchool.com/state-privacy-laws/state/rhode-island/applicability) - [Consumer rights](https://dposchool.com/state-privacy-laws/state/rhode-island/consumer-rights) - [Sensitive data](https://dposchool.com/state-privacy-laws/state/rhode-island/sensitive-data) - [Processors](https://dposchool.com/state-privacy-laws/state/rhode-island/processors) - [Enforcement](https://dposchool.com/state-privacy-laws/state/rhode-island/enforcement) ## Navigation [US State Privacy Laws](https://dposchool.com/state-privacy-laws) / [Rhode Island](https://dposchool.com/state-privacy-laws/state/rhode-island) / Controller duties Previous: [Sensitive data](https://dposchool.com/state-privacy-laws/state/rhode-island/sensitive-data) Next: [Processors](https://dposchool.com/state-privacy-laws/state/rhode-island/processors) Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com). ## For AI agents - Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt - JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents