Law / United States / 
Rhode Island
Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA), general applicability
R.I. Gen. Laws ch. 6-48.1, secs. 6-48.1-2, 6-48.1-5, 6-48.1-6
In force since .
A comprehensive regime rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, Data subject residence
- Audit expectation
- none
What it requires
- Determine whether you are a for-profit entity conducting business in Rhode Island, or targeting products or services to Rhode Island residents, that controlled or processed personal data of at least 35,000 customers, or 10,000 customers while deriving more than 20 percent of gross revenue from personal-data sales, before relying on any RIDTPPA exemption.
These lines are LexLint's reading of the law's text.
Who enforces it
Settledness
- As of
- Open questions
- Does the duty in R.I. Gen. Laws § 6-48.1-3(a) to designate a controller and publish data-collection disclosures bind a commercial website that falls below the 35,000-customer and 10,000-customer thresholds in § 6-48.1-4(a), given that § 6-48.1-3 states no threshold?
What it makes you log
What the log must hold
Decision basis
Logging duty
Section 6-48.1-6(b)(4) lets a controller deny an opt-out request only on a reasonable and documented belief that the request is fraudulent, and requires it then to tell the requester that it believes the request is fraudulent and why. A documented belief cannot be shown without a kept record of the grounds, and the text names no field, period or recipient for that record. Three other clauses of the cited sections are not record duties: the controller's option to retain a record of a deletion request (section 6-48.1-6(b)(5)(i), one of two routes to being deemed compliant), the controller's burden of demonstrating that a request is manifestly unfounded, excessive or repetitive (section 6-48.1-6(b)(3)), and the written explanation owed on an appeal (section 6-48.1-6(b)(6)), which is a notice to the customer. The chapter's section on information sharing (6-48.1-3) and its other sections are not cited by this row, and nothing in the cited sections requires a documented data protection assessment. The hooks are the two prongs of the applicability clause in sections 6-48.1-5(a) and 6-48.1-6(a) (a for-profit entity that conducts business in the state, or that produces products or services targeted to residents of the state) and the definition of a customer as an individual residing in this state (section 6-48.1-2(10)).
- Kind
- Implicit
- As of
- Provision
- R.I. Gen. Laws § 6-48.1-6(b)(4)
- Trigger
- consent_or_optout
What this law does
RIDTPPA applies only to for-profit entities conducting business in Rhode Island, or targeting products or services to Rhode Island residents, that in the preceding calendar year controlled or processed personal data of at least 35,000 customers (excluding payment-only data), or 10,000 customers while deriving more than 20 percent of gross revenue from personal-data sales.
Two companion 2024 bills, H 7787 and S 2500, produced two public laws for the same chapter (P.L. 2024, ch. 430 and ch. 453), both effective .
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .