The controller must conduct and document a data protection assessment for each processing activity presenting a heightened risk of harm, which includes targeted advertising, the sale of personal data, profiling that presents a reasonably foreseeable risk of unfair or deceptive treatment or unlawful disparate impact, financial, physical or reputational injury, offensive intrusion on seclusion or other substantial injury, and the processing of sensitive data. The Attorney General may require an assessment relevant to an investigation, which stays confidential, exempt from public records access and without waiver of privilege. One assessment may cover comparable operations; an assessment done under another law counts if reasonably similar in scope and effect; the duty applies to processing activities created or generated after 1 January 2026 and is not retroactive. Applies to for-profit entities doing business in Rhode Island or targeting products or services to its residents that in the preceding calendar year controlled or processed personal data of at least 35,000 customers (excluding data processed solely to complete a payment) or of at least 10,000 customers while deriving more than 20 percent of gross revenue from selling personal data.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.