← All US breach laws·RI

Rhode Island data breach notification law

Rhode Island's data breach notification requirements under R.I. Gen. Laws §§11-49.3-1 to 11-49.3-6 (Identity Theft Protection Act of 2015). Below: the resident-notification deadline, AG/regulator filing threshold, the encryption safe harbor, private right of action exposure, penalty schedule, and the common pitfalls that turn an avoidable incident into a regulator enforcement action.

Statute
R.I. Gen. Laws §§11-49.3-1 to 11-49.3-6
Enforcer
Rhode Island Attorney General
AG notification
Required
Private right of action
Yes — residents can sue

Notification deadlines

Notify affected residents
In the most expedient time possible and without unreasonable delay, but no later than 45 days after confirmation of breach and the ability to ascertain required information
Notify the state regulator
Yes — if more than 500 RI residents are affected, written notice to the AG
Notify consumer reporting agencies
Yes — if more than 500 residents, notify nationwide CRAs

When is notification required?

Trigger / harm threshold
Notification required if there is significant risk of identity theft
Encryption safe harbor
Yes — properly encrypted personal information is generally exempt from notification, provided the encryption key was not also compromised.

What counts as "personal information" under Rhode Island law

First name/initial + last name with SSN, DL/state ID, financial account + access code, medical or health-insurance info, biometric data, OR username/email + password/security Q&A

Penalties and enforcement

Up to $100 per resident not notified, capped at $25,000 for reckless breach; private right of action
Enforced by: Rhode Island Attorney General. Official regulator page →

Common pitfalls

⚠ Rhode Island requires a written information-security program — separately enforceable

Frequently asked questions

How long do I have to notify Rhode Island residents after a data breach?
In the most expedient time possible and without unreasonable delay, but no later than 45 days after confirmation of breach and the ability to ascertain required information
Do I have to notify the Rhode Island Attorney General?
Yes — if more than 500 RI residents are affected, written notice to the AG
Does Rhode Island require notification to nationwide consumer reporting agencies?
Yes — if more than 500 residents, notify nationwide CRAs
Is encrypted data exempt from Rhode Island's breach notification requirement?
Yes — Rhode Island has an encryption safe harbor. Breaches of properly encrypted personal information generally do not trigger notification, provided the encryption key was not also compromised.
Can Rhode Island residents sue me directly for a data breach?
Yes — Rhode Island allows a private right of action. Affected residents may sue for actual damages and, in some cases, statutory damages or attorneys' fees. Class actions are common.
What counts as 'personal information' under Rhode Island law?
First name/initial + last name with SSN, DL/state ID, financial account + access code, medical or health-insurance info, biometric data, OR username/email + password/security Q&A
What are the penalties for failing to comply with Rhode Island's breach notification law?
Up to $100 per resident not notified, capped at $25,000 for reckless breach; private right of action

Related state breach laws

Oregon (OR)
Ore. Rev. Stat. §§646A.600 to 646A.628
Pennsylvania (PA)
73 Pa. C.S. §§2301 to 2330
South Carolina (SC)
S.C. Code §39-1-90
South Dakota (SD)
S.D. Codified Laws §§22-40-19 to 22-40-26

Pre-empt the Rhode Island breach notice — audit your policy now

ComplianceIQ runs a free audit of your privacy policy and incident-response language against Rhode Island's statutory requirements. You'll see every gap before you have to use it for real.

Run free policy audit