Compare tool
Compare state data breach notification laws
Choose up to six states. Fields come from the PRC 2026 survey extract; blanks show as not extracted.
| Field | Rhode Island |
|---|---|
| Statute citation | R.I. Gen. Laws §§ 11-49.3-1 to 11-49.3-7 (Rhode Island Identity Theft Protection Act of 2015) (amended 2023) |
| Individual notice timing | 45-day |
| Attorney general notice | Yes Rhode Island requires notification to the Attorney General when more than 500 Rhode Island |
| Biometric data | No |
| Medical information | Yes |
| Government ID numbers | Not extracted |
| Paper records | Yes |
| Private right of action | No |
| Credit monitoring required | Not extracted |
| Breach definition (excerpt) | In Rhode Island 'breach of the security of the system' means unauthorized access or acquisition of unencrypted, computerized data information that compromises the security, confidentiality, or integrity of personal information maintained by the municipal agency, state agency, or person; good-faith acquisition of personal information by an employee or agent of the agency for the purposes of the agency is not a breach of the security of the system, provided that the personal information is not use |