Governance, risk & compliance

Rhode Island Data Transparency and Privacy Protection Act R.I. Gen. Laws 6-48.1-1 to 6-48.1-10 (2024)

The Rhode Island Data Transparency and Privacy Protection Act (R.

I. Gen.

Laws 6-48. 1-1 to 6-48.

1-10, P. L.

2024 chs. 430 and 453), effective 1 January 2026.

It applies to for-profit entities that do business in Rhode Island or target its residents and handled the data of at least 35,000 customers, or at least 10,000 customers while earning more than 20% of gross revenue from sale. Nonprofits, higher education, GLBA financial institutions, state bodies and HIPAA covered entities are exempt.

A commercial website or internet service provider must designate a controller and, if it sells customer data, identify the categories collected and the third parties sold to. Customers can access, correct, delete, get a portable copy, and opt out of targeted advertising, sale and profiling, with a 45-day response and a 60-day appeal.

Controllers need consent for sensitive data, must honour revocation within 15 days, and must assess heightened-risk processing created after 1 January 2026. A violation is a deceptive trade practice, with a $100 to $500 fine for each intentional improper disclosure; the Attorney General alone enforces and there is no cure period or private right in the text read.

Not verified: (1) The sensitive data definition was not itemized. (2) The Act has no universal opt-out signal, no teen rule beyond known-child data under COPPA, and no cure period in the text read.

(3) Rules or guidance from the Rhode Island Attorney General were not looked for. General information for compliance work, not legal advice.

Assessment tiers & levels Lavawall supports

Lavawall assesses Rhode Island Data Transparency and Privacy Protection Act at every level below, so you can start where you are and step up as your program matures.

How Lavawall® helps you get to Rhode Island Data Transparency and Privacy Protection Act compliance

Most of Rhode Island Data Transparency and Privacy Protection Act comes down to technical controls you have to run and prove: keeping systems patched, hardening configuration, detecting breaches early, backing up what matters, controlling access, and keeping evidence that all of it actually happened. Lavawall® runs those controls across Windows, macOS, Linux, and Microsoft 365 / Google Workspace from one console, maps them to Rhode Island Data Transparency and Privacy Protection Act, and tracks your posture continuously instead of once a year at audit time.

• Assess your current state against Rhode Island Data Transparency and Privacy Protection Act in the Lavawall GRC module, with the questionnaire and control set built in.
• Remediate the gaps with the same platform — automated patching, configuration fixes, backups, and access review — not a separate project.
• Evidence everything with timestamped, exportable records auditors, insurers, and clients accept.

Related

Lavawall® supports Rhode Island Data Transparency and Privacy Protection Act as part of a built-in catalogue of compliance frameworks. Framework requirements are summarized for planning purposes; always confirm the current official text before certifying.