HomeChecklistsRhode Island Checklist

Rhode Island Privacy Compliance Checklist

Rhode Island Data Transparency and Privacy Protection Act — Step-by-step guide to compliance

Reviewed by PrivacyLawMap editorial teamLast verified: July 28, 2026

What is the RIDTPPA compliance checklist?

The RIDTPPA compliance checklist is a 12-step plan for meeting the Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA), Rhode Island's consumer privacy law, which took effect January 1, 2026. It is enforced by the Rhode Island Attorney General — Consumer Protection Unit, with civil penalties up to $10,000 per violation and no cure period. Work through every step below, then confirm your specific obligations with the free applicability calculator.

Compliance Steps

Effective: January 1, 2026

1
Assess applicability — note the significantly lower thresholds: 35,000 consumers (excluding payment-only data) OR 10,000 consumers with 20%+ data sale revenue. Also verify entity-level exemptions: HIPAA-covered entities, GLBA financial institutions, nonprofits, government, higher education. Note exemptions apply at entity level; data processed outside exempted activities remains covered
2
Update privacy notices with all RIDTPPA-required disclosures: categories of personal data processed, purposes of processing, categories of third parties receiving data, consumer rights and exercise methods, data sale and targeted advertising disclosures, and controller contact information
3
Implement consumer rights request mechanisms with 45-day response period (extendable by 45 additional days with notice and justification). Include identity verification procedures proportionate to the sensitivity of the data and risk of unauthorized access
4
Obtain opt-in consent for all eight sensitive data categories: racial/ethnic origin, religious beliefs, health diagnosis, sexual orientation, citizenship/immigration status, genetic/biometric data (processed for identification, excluding photos/audio/video), precise geolocation (within 1,750-foot radius), and known children's data (under 13). Consent must be freely given, specific, informed, and unambiguous
5
Implement children's data protections — obtain verifiable parental consent before processing data of known children under 13. For teens (13-17), obtain opt-in consent before targeted advertising or data sales. Align with the COPPA Rule amendments effective June 23, 2025 and fully applicable after the April 22, 2026 main compliance date
6
Implement opt-out mechanisms for data sales, targeted advertising, and profiling with significant legal or similarly significant effects. No GPC mandate — traditional opt-out links and methods are sufficient, but must be clear, conspicuous, and functional
7
Establish a documented appeals process for denied consumer requests — respond within 60 days and inform consumers of their right to file complaints with the Rhode Island Attorney General's Consumer Protection Unit
8
Execute processor agreements (Data Processing Agreements) with all service providers processing personal data. Include RIDTPPA-mandated provisions: processing instructions, confidentiality obligations, data security requirements, sub-processor controls, deletion/return obligations, and cooperation with consumer rights requests
9
Conduct data protection assessments for processing activities presenting heightened risk to consumers: targeted advertising, data sales, profiling, processing sensitive data, and any processing creating foreseeable risk of substantial injury. Document assessments and retain records
10
Implement data minimization practices — collect only personal data that is adequate, relevant, and reasonably necessary for the disclosed purposes. Establish data retention schedules and purge data no longer needed
11
Prepare for AG enforcement inquiries — there is no cure period, so have a documented compliance program ready. Maintain records of consent, consumer requests, data protection assessments, and processor agreements. The AG can investigate and pursue penalties immediately upon discovery of violations
12
Map multistate compliance obligations — compare RIDTPPA requirements against Delaware (similar low thresholds, GPC required), New Hampshire (GPC required since January 1, 2025; cure period expired), and Maryland (data minimization, GPC required). Identify gaps where RI-specific obligations differ from sister states

Key Enforcement Details

Enforced By

Rhode Island Attorney General — Consumer Protection Unit

Penalty / Violation

$10,000

Cure Period

None

Private Right of Action

Related Resources

Rhode Island Privacy Law — Full Guide
Compare Rhode Island with Other States
Rhode Island Enforcement Actions & Privacy Fines
2026-2027 Privacy Law Compliance Deadlines
All State Privacy Laws

RIDTPPA Compliance Checklist FAQ

What is the RIDTPPA compliance checklist?

It is a 12-step plan organizations use to meet the Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA), which took effect January 1, 2026. The steps below cover consumer-rights request handling, privacy-notice disclosures, opt-out mechanisms, data-processing agreements, and security safeguards required under Rhode Island law.

Who has to comply with the Rhode Island Data Transparency and Privacy Protection Act?

The RIDTPPA generally applies to organizations that handle Rhode Island residents' personal data above the law's revenue and data-volume thresholds. Whether it applies to you depends on the specifics — check your exact obligations with the free applicability calculator at /calculator rather than assuming.

What is the penalty for RIDTPPA non-compliance?

The Rhode Island Attorney General — Consumer Protection Unit can impose civil penalties of up to $10,000 per violation and no cure period. There is no private right of action, so enforcement comes from the state, not individual lawsuits. Figures verified July 28, 2026.

Put RIDTPPA Into Practice on Your SiteSponsored

Termly builds and maintains a Rhode Island-ready privacy policy, a cookie consent banner, opt-in consent capture for sensitive data, and a workflow for the access, deletion and correction requests RIDTPPA grants.

Start Free with Termly

Does this law apply to you?

Use our free calculator to check if Rhode Island Data Transparency and Privacy Protection Act applies to your business.

Check Applicability

Official Resources

RIDTPPA Full Text — R.I. Gen. Laws §§ 6-48.1 (Rhode Island Legislature)
H 7787A Bill Text (2024 Session)
Rhode Island Attorney General — Consumer Protection
File a Consumer Complaint (Rhode Island AG)
Rhode Island Deceptive Trade Practices Act (§ 6-13.1)
FTC COPPA Rule Amendments — Federal Register (90 FR 16918)
IAPP — Rhode Island Enacts Comprehensive Privacy Law