Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA) 6-48.1-6(b)(1) to (3): Section 6-48.1-6(b)(1) to (3): responses within 45 days, one 45-day extension, free once a year

What does 6-48.1-6(b)(1) to (3) require?

The controller must respond without undue delay and within 45 days of receipt, extendable once by 45 days where reasonably necessary for complexity or volume if the customer is told of the extension and the reason within the first 45 days. If it declines to act it must say so within 45 days with the justification and instructions for appeal. Responses are free once per customer in any twelve months; for manifestly unfounded, excessive or repetitive requests it may charge a reasonable administrative fee or decline, bearing the burden of showing that character. Applies to for-profit entities doing business in Rhode Island or targeting products or services to its residents that in the preceding calendar year controlled or processed personal data of at least 35,000 customers (excluding data processed solely to complete a payment) or of at least 10,000 customers while deriving more than 20 percent of gross revenue from selling personal data.