Rhode Island privacy law (RIDTPPA): processors

Key points

1. Processors must follow controller instructions and assist with the controller's obligations.

   Section: § 6-48.1-7(b)

2. A binding contract must set out instructions, nature and purpose, data types, duration and the rights and obligations of both parties.

   Section: § 6-48.1-7(c)

3. The contract must impose a duty of confidentiality on each person processing the data.

   Section: § 6-48.1-7(c)(1)

4. Delete or return all personal data at the end of services, unless the law requires retention.

   Section: § 6-48.1-7(c)(2)

5. Subcontractors only after the controller has had an opportunity to object, and under a written contract with the same obligations.

   Section: § 6-48.1-7(c)(4)

6. Allow reasonable assessments, or arrange an independent assessment and give the report to the controller on request.

   Section: § 6-48.1-7(c)(5)

7. A processor that starts deciding purposes and means becomes a controller for that processing.

   Section: § 6-48.1-7(d)

Sources

• https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/6-48.1-7.htm

Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

• Article 28: Processor (processors)