---
title: "Rhode Island privacy law (RIDTPPA): processors"
canonical: "https://dposchool.com/state-privacy-laws/state/rhode-island/processors"
source: "https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/INDEX.htm"
text_as_of: "2026-10-28"
last_reviewed: "2026-10-29"
language: "en-US"
publisher: "DPO School"
---

Rhode Island Data Transparency and Privacy Protection Act

# Rhode Island privacy law (RIDTPPA): processors

Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review)

## Summary (not the statute text)

Processors must follow the controller's instructions and help it meet its obligations. A binding contract must set out processing instructions, the nature and purpose of processing, the data types, the duration, and both parties' rights and obligations. It must also require confidentiality, deletion or return at the end of services, information to show compliance, subcontracting only after the controller can object and under a written contract, and cooperation with assessments.

## Key points

1. Processors must follow controller instructions and assist with the controller's obligations.

   Section: [§ 6-48.1-7(b)](https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/INDEX.htm)

2. A binding contract must set out instructions, nature and purpose, data types, duration and the rights and obligations of both parties.

   Section: [§ 6-48.1-7(c)](https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/INDEX.htm)

3. The contract must impose a duty of confidentiality on each person processing the data.

   Section: [§ 6-48.1-7(c)(1)](https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/INDEX.htm)

4. Delete or return all personal data at the end of services, unless the law requires retention.

   Section: [§ 6-48.1-7(c)(2)](https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/INDEX.htm)

5. Subcontractors only after the controller has had an opportunity to object, and under a written contract with the same obligations.

   Section: [§ 6-48.1-7(c)(4)](https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/INDEX.htm)

6. Allow reasonable assessments, or arrange an independent assessment and give the report to the controller on request.

   Section: [§ 6-48.1-7(c)(5)](https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/INDEX.htm)

7. A processor that starts deciding purposes and means becomes a controller for that processing.

   Section: [§ 6-48.1-7(d)](https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/INDEX.htm)

## Sources

- [https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/6-48.1-7.htm](https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/6-48.1-7.htm)

[Compare processors across all states](https://dposchool.com/state-privacy-laws/topic/processors)

## Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

- [Article 28: Processor](https://dposchool.com/gdpr/article/28) (processors)

## Status

Law as of October 28, 2026.

[Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed.

[Official text of the Rhode Island statute](https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/INDEX.htm)

Reference material, not legal advice.

## Other topics for Rhode Island

- [Applicability](https://dposchool.com/state-privacy-laws/state/rhode-island/applicability)
- [Consumer rights](https://dposchool.com/state-privacy-laws/state/rhode-island/consumer-rights)
- [Sensitive data](https://dposchool.com/state-privacy-laws/state/rhode-island/sensitive-data)
- [Controller duties](https://dposchool.com/state-privacy-laws/state/rhode-island/controller-duties)
- [Enforcement](https://dposchool.com/state-privacy-laws/state/rhode-island/enforcement)

## Navigation

[US State Privacy Laws](https://dposchool.com/state-privacy-laws) / [Rhode Island](https://dposchool.com/state-privacy-laws/state/rhode-island) / Processors

Previous: [Controller duties](https://dposchool.com/state-privacy-laws/state/rhode-island/controller-duties)

Next: [Enforcement](https://dposchool.com/state-privacy-laws/state/rhode-island/enforcement)

Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com).

## For AI agents

- Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt
- JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents