Law / United States / 
Rhode Island
Rhode Island Data Transparency and Privacy Protection Act, data protection assessments
R.I. Gen. Laws sec. 6-48.1-7(a), (e) to (i)
In force since .
A comprehensive regime rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting
- Obligation class
- DPIA
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
As of .
What it requires
- Conduct and document a data protection assessment for each of your processing activities that presents a heightened risk of harm to a Rhode Island customer, including targeted advertising, the sale of personal data, profiling that presents a reasonably foreseeable risk of unfair treatment, injury, intrusion or other substantial injury, and the processing of sensitive data (R.I. Gen. Laws sec. 6-48.1-7(e)).
- Make a data protection assessment available to the attorney general when the attorney general requires its disclosure for an investigation (R.I. Gen. Laws sec. 6-48.1-7(f)).
These lines are LexLint's reading of the law's text, as of .
What it makes you log
Who may demand the log
Regulator
What the log must hold
Decision basis
Logging duty
A controller must conduct and document a data protection assessment for each processing activity that presents a heightened risk of harm to a customer (6-48.1-7(e)). The attorney general may require a controller to disclose any assessment relevant to an investigation, and the controller must make it available; the attorney general may evaluate it for compliance with the chapter, and assessments are confidential and exempt from the public records law (6-48.1-7(f)). The section sets no period for keeping an assessment and lists no contents, so the contents are the decision basis the assessment documents. The scope clause in 6-48.1-7(a) applies the section to for-profit entities that conduct business in the state or produce products or services targeted to residents of the state. The cited rows 6-48.1-2, 6-48.1-5, 6-48.1-6 and 6-48.1-8 hold no assessment duty.
- Kind
- Explicit
- As of
- Provision
- R.I. Gen. Laws sec. 6-48.1-7(e) and (f) (documented data protection assessments)
- Trigger
- personal_data_processing
What this law does
A controller must conduct and document a data protection assessment for each processing activity that presents a heightened risk of harm to a customer, which includes targeted advertising, the sale of personal data, some profiling and the processing of sensitive data. The attorney general may require a controller to disclose any data protection assessment that is relevant to an investigation, and the controller must make it available.
Data protection assessments are confidential and exempt from disclosure under the access to public records law. The assessment requirements apply to processing activities created or generated after , and are not retroactive. The section applies to for-profit entities that conduct business in the state or produce products or services targeted to residents of the state and that meet one of two thresholds on the number of customers whose personal data they control or process.
When LexLint raises it
When your app profile says your app sends automated outreach, crawls the web, deploys a chatbot, processes biometric data, processes voice recordings, trains models or makes high-risk automated decisions.