Rhode Island Data Breach Notification Law

The Rhode Island data breach notification law reaches paper records

The Rhode Island data breach notification law, part of the Identity Theft Protection Act of 2015, covers paper records as well as unencrypted electronic data ¹. It applies to anyone who stores, owns, collects, processes, maintains, acquires, uses or licenses personal information, vendors included ¹.

On top of the standard elements, Rhode Island adds:

• Medical information and health insurance information
• Online account credentials, including an email address with a required code or password
• Tribal ID numbers

That list matters for medical and dental offices, benefits brokers and any business whose staff log in to cloud accounts ². A phished mailbox that held client records can trigger the law on its own.

The 45-day clock and what starts it

Notice is due in the most expedient time possible, and no later than 45 calendar days after two things are true: the business has confirmed the breach, and it is able to gather the information the notice must contain ¹.

That second condition is not a way to wait indefinitely. A forensic firm can usually tell you what systems were touched well before it finishes its report. Treat day 45 as counting from confirmation and push the investigation to fill in the notice contents inside that window.

The notice to residents must cover set points ¹:

• A description of the incident and the data involved
• When the breach happened and when it was found
• What remediation services are being offered
• How to get a police report and how to request a security freeze

Calendar days count weekends and holidays, so a breach confirmed on a Friday leaves fewer working days than it seems.

Telling the Rhode Island Attorney General and credit bureaus

If more than 500 Rhode Island residents are to be notified, the business must tell the Attorney General and the major credit reporting agencies about the timing, content and distribution of the notices and the approximate number of people affected ¹.

The statute sets no separate deadline for this, but it must not delay notice to residents ¹. In practice, send it with or just before the resident letters, so the AG's office is not learning of the breach from a news report or a resident's call.

Below the 500 line, no state notice is required, but residents still get their letters within 45 days.

Risk of identity theft, encryption and penalties

Notice is owed only for a disclosure or breach that poses a significant risk of identity theft to a Rhode Island resident ¹. The current text builds that test into the trigger itself rather than offering a separate no-notice finding, and it sets no documentation rule ¹. Keep your reasoning in writing anyway.

Encryption earns an exemption only if it is strong. Data encrypted with a 128 bit or higher process is exempt, but it does not count as encrypted if it is acquired together with any key, security code or password ². A stolen laptop with full-disk encryption is usually outside the law. A stolen laptop with the password on a sticky note is not.

Penalties are counted per record, which makes them grow with the size of the breach. The Attorney General may sue, and each reckless violation carries a civil penalty of up to $100 per record, and each knowing and willful violation up to $200 per record ³. The statute names the AG as enforcer and is silent on private lawsuits, so whether individuals can sue under it is unclear.

A 2026 Senate bill would have rewritten the Act's definitions and raised penalties. It passed the Senate in June 2026 but stalled in House Judiciary and had not been enacted when we checked, so the rules above are the ones in force.

Security program duties and the new privacy law

Rhode Island expects prevention as well as notice. Businesses that hold personal information must implement and maintain a risk-based information security program with reasonable security procedures appropriate to their size and scope ⁴, and their contracts with vendors must require protection of shared data ¹. A written information security plan is the usual way to show both.

Since January 1, 2026, the Rhode Island Data Transparency and Privacy Protection Act also applies to some larger businesses. It covers for-profit businesses that controlled or processed personal data of at least 35,000 Rhode Island customers in the prior year, or at least 10,000 while earning more than 20% of gross revenue from selling personal data ⁵. Few small firms reach 35,000 Rhode Island customers, but a consumer business with a large list should check.

Responding to a Rhode Island breach

In a live incident, a Rhode Island business with cyber coverage calls its carrier first, alerts the FBI with a report at ic3.gov, and preserves evidence rather than reimaging machines ⁶⁹⁷. IC3 counted 2,700 complaints from Rhode Island in 2025 and about $72 million in reported losses ⁸.

After that:

1. Have your IT vendor or a breach containment team stop the attack and confirm what was taken.
2. Ask the carrier which panel lawyers you must use; cyber policy fine print explains why it matters.
3. Sort the list by state and check the 500 line for Rhode Islanders. Massachusetts and Connecticut residents bring their own laws, and the rules for every state are side by side in our table.
4. Mark day 45 on the calendar and draft the notice with the required contents.

Medical and dental offices face a second deadline under HIPAA's patient notice rule. Our Providence page covers local IT support costs.

The Identity Theft Protection Act was compared with this page on October 13, 2026. Read it as a guide, not legal advice, and confirm your obligations with a lawyer who knows the Act.