Rhode Island. Breach notification. Act
RI breach lawRhode Island data breach notification law (R.I. Gen. Laws § 11-49.3-1 et seq. (Identity Theft Protection Act of 2015))
Partly verified
Medium confidence.Vendor notice provision not described on summary page.
§1Summary
- Synopsis
Requires businesses (and in most cases public bodies) that own or license computerised personal information about Rhode Island residents to notify affected individuals after a security breach. Core timing rule: Individuals within 45 calendar days of confirming breach. Covered data: name plus SSN, driver's/state/tribal ID, financial account with codes, medical/health insurance data, email credentials.
- Key themes
- Unique features
Specifies a 128-bit encryption standard; covers paper records; public bodies must offer five years of credit remediation.
- SaaS relevance
A SaaS provider hosting customer data is usually the 'maintaining' entity, not the owner: Rhode Island's vendor duties are framed through security contracts rather than a separate notice deadline. The owner customer then carries the individual and regulator notices, so contracts should fix timelines and cooperation.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- Individuals within 45 calendar days of confirming breach; AG and CRAs if >500 residents
- DPO
- No
- Cross-border transfers
- None
- Maximum penalty
- Up to $100 per record (reckless) or $200 per record (knowing and wilful)
§3Dates
- Key dates
- Adopted
- In force
- HB 5684 (2023, eff. 2023-06-27) latest amendment
§4Text and authority
- Text
- Authoritative text webserver.rilegislature.gov
- Authority
- Rhode Island Attorney General
§5Where it applies
- Domestic law of
- Rhode Island
§6Sources and verification
- Sources consulted
- Verification
Medium confidence.
Partly verified
Medium confidence.Vendor notice provision not described on summary page.