Law / United States / 
Rhode Island
Insurance Data Security: notice of a cybersecurity event to the Commissioner by a domestic insurer
In force since .
A breach notification rule binding private bodies.
- Obligation class
- Breach notice, Reporting
- Audit expectation
- none
As of .
What it requires
- As a domestic insurer, notify the commissioner as promptly as possible, and no later than three business days from a determination that a cybersecurity event has occurred, when you must give notice of the event to any government body, self-regulatory agency or other supervisory body under state or federal law, or the event has a reasonable likelihood of materially harming any consumer residing in Rhode Island or any material part of your normal operations (section 27-1-47(a)).
- Provide the notice in electronic form as the commissioner directs, with as much as possible of the listed information (the date of the event, how the information was exposed, lost, stolen or breached, how the event was discovered, whether the information was recovered, the source of the event, any police report or notice to regulators, the types of information acquired, the period of compromise, the best estimate of affected Rhode Island consumers, the results of your internal review, your remediation efforts, a copy of your privacy policy and your plan to investigate and notify consumers, and a contact person), and keep updating and supplementing the notice (section 27-1-47(b)).
- Comply with chapter 49.3 of title 11 as applicable, and give the commissioner a copy of the notice sent to consumers when you are required to notify the commissioner (section 27-1-47(c)).
- Treat a cybersecurity event involving your nonpublic information in a system maintained by a third-party service provider as you would under subsection (a); your deadlines begin the day after the provider notifies you or you otherwise have actual knowledge, whichever is sooner (section 27-1-47(d)).
- As an assuming insurer, notify your affected ceding insurers and the commissioner of your state of domicile within seventy-two hours of determining that a cybersecurity event has occurred, or of receiving notice from your third-party service provider (section 27-1-47(e)).
- Notify the producers of record of all affected consumers who accessed your services through an independent insurance producer as soon as practicable as the commissioner directs, unless you lack current producer of record information for an individual consumer (section 27-1-47(f)).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Settledness
- As of
What this law does
Section 27-1-47(a) of the Rhode Island General Laws requires each domestic insurer to notify the commissioner as promptly as possible, and no later than three business days from a determination that a cybersecurity event has occurred, when a cybersecurity event impacting the insurer must be reported to a government body, self-regulatory agency or other supervisory body under state or federal law, or has a reasonable likelihood of materially harming any consumer residing in this state or any material part of the insurer's normal operations.
Section 27-1-47(b) of the Rhode Island General Laws requires the insurer to provide the information in electronic form as the commissioner directs and gives it a continuing obligation to update and supplement initial and subsequent notifications.
Section 27-1-47(b) of the Rhode Island General Laws requires the insurer to provide as much as possible of a listed set of information, including the date of the event, how the information was exposed, how the event was discovered, the number of total consumers in this state affected, and a copy of the insurer privacy policy.
Section 27-1-47(c) of the Rhode Island General Laws requires an insurer to comply with chapter 49.3 of title 11, as applicable, and to provide the commissioner a copy of the notice sent to consumers under that chapter when the insurer is required to notify the commissioner.
Section 27-1-47(d) of the Rhode Island General Laws requires an insurer to treat a cybersecurity event involving its nonpublic information in a system maintained by a third-party service provider as it would under subsection (a), with its deadlines beginning on the day after the provider notifies it or it otherwise has actual knowledge, whichever is sooner.
Section 27-1-47(e) of the Rhode Island General Laws requires an assuming insurer to notify its affected ceding insurers and the commissioner of its state of domicile within seventy-two hours of making the determination that a cybersecurity event has occurred.
Section 27-1-47(f) of the Rhode Island General Laws requires an insurer to notify the producers of record of all affected consumers who accessed the insurer's services through an independent insurance producer as soon as practicable as the commissioner directs, and excuses the insurer where it lacks current producer of record information for an individual consumer.
Section 27-1-47 of the Rhode Island General Laws was enacted by Public Law 2024, chapter 354, section 2, and Public Law 2024, chapter 355, section 2, each effective . Section 27-1-47 of the Rhode Island General Laws was amended by Public Law 2025, chapter 427, article 1, section 2, effective .
Public Law 2025, chapter 427 (H 6385 Substitute A), enacted , amended sections 27-1-46 and 27-1-47 of the General Laws, the first headed Information security program.
When LexLint raises it
When your app profile says your app is an insurer.