DPO SchoolDPO School

Rhode Island Data Transparency and Privacy Protection Act

Rhode Island privacy law (RIDTPPA): enforcement

Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026

Summary (not the statute text)

The Attorney General has sole enforcement authority and no private right of action exists. A violation is a deceptive trade practice under chapter 13.1 of title 6, which carries a civil penalty of up to $10,000 per violation. Separately, anyone who intentionally discloses personal data to a shell company formed to evade the Act, or in violation of the Act, faces a fine of $100 to $500 per disclosure. There is no cure period.

Key points

  1. The Attorney General has sole enforcement authority.

    Section: § 6-48.1-8(b)

  2. A violation is a deceptive trade practice under chapter 13.1 of title 6.

    Section: § 6-48.1-8(a)

  3. Deceptive trade practices carry a civil penalty of up to $10,000 per violation.

    Section: § 6-13.1-8

  4. Intentional unlawful disclosures, including to a shell company set up to evade the Act, carry a fine of $100 to $500 per disclosure.

    Section: § 6-48.1-8(a)(1), (2)

  5. No private right of action under the Act or any other law.

    Section: § 6-48.1-8(c)

  6. No notice-and-cure period is provided.

    Section: § 6-48.1-8

  7. Waivers of the Act are void.

    Section: § 6-48.1-9

Sources

Compare enforcement across all states

Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

Law as of October 28, 2026.

Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.

Official text of the Rhode Island statute

Reference material, not legal advice.