Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA)
Rhode Island's Data Transparency and Privacy Protection Act (R.I. Gen. Laws ch. 6-48.1), effective 1 January 2026: disclosure of data categories and buyers by commercial websites and ISPs, sale and targeted advertising disclosure, security, consent for sensitive data and COPPA for children, fifteen-day consent revocation, access, correction, deletion, portability and opt-outs from targeted advertising, sale and significant profiling, 45-day responses and sixty-day appeals, processor contracts, data protection assessments, de-identified data commitments; thresholds of 35,000 customers or 10,000 with 20 percent data-sale revenue; Attorney General enforcement with no private right of action and no cure period. Built from the official statute text.
Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA) is a compliance framework from United States (Rhode Island) with 4 domains and 16 controls that map to 171 other frameworks. The largest domains are Sections 6-48.1-5 and -6: customer rights and how they are exercised – Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA) (6 controls), Section 6-48.1-4: processing of information (security, sensitive data, consent) – Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA) (4 controls), Section 6-48.1-7: controller and processor responsibilities, assessments, de-identified data, exemptions – Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA) (4 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (4)
Section 6-48.1-3: information sharing practices, scope and exempt entities and data – Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA)
| Code | Title |
|---|---|
| rhode-island-data-transparency-and-privacy-protection-act-ridtppa::6-48.1-3(a) | Section 6-48.1-3(a): commercial websites and ISPs designate a controller and disclose data categories and buyers |
| rhode-island-data-transparency-and-privacy-protection-act-ridtppa::6-48.1-3(b) | Section 6-48.1-3(b): clear and conspicuous disclosure of sale and targeted advertising |
Section 6-48.1-4: processing of information (security, sensitive data, consent) – Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA)
| Code | Title |
|---|---|
| rhode-island-data-transparency-and-privacy-protection-act-ridtppa::6-48.1-4(b) | Section 6-48.1-4(b): reasonable administrative, technical and physical data security |
| rhode-island-data-transparency-and-privacy-protection-act-ridtppa::6-48.1-4(c) | Section 6-48.1-4(c): consent before processing sensitive data, COPPA for known children |
| rhode-island-data-transparency-and-privacy-protection-act-ridtppa::6-48.1-4(d) | Section 6-48.1-4(d): no processing in breach of anti-discrimination laws |
| rhode-island-data-transparency-and-privacy-protection-act-ridtppa::6-48.1-4(e) | Section 6-48.1-4(e): a mechanism to grant and revoke consent, effective within fifteen days |
Section 6-48.1-7: controller and processor responsibilities, assessments, de-identified data, exemptions – Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA)
| Code | Title |
|---|---|
| rhode-island-data-transparency-and-privacy-protection-act-ridtppa::6-48.1-7(b) to (d) | Section 6-48.1-7(b) to (d): processor instructions and the controller-processor contract |
| rhode-island-data-transparency-and-privacy-protection-act-ridtppa::6-48.1-7(e) to (i) | Section 6-48.1-7(e) to (i): data protection assessments for heightened-risk processing |
| rhode-island-data-transparency-and-privacy-protection-act-ridtppa::6-48.1-7(j) and (n) | Section 6-48.1-7(j) and (n): de-identified and pseudonymous data commitments |
| rhode-island-data-transparency-and-privacy-protection-act-ridtppa::6-48.1-7(s) | Section 6-48.1-7(s): processing reasonably necessary and proportionate, with safeguards |
Sections 6-48.1-5 and -6: customer rights and how they are exercised – Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA)
| Code | Title |
|---|---|
| rhode-island-data-transparency-and-privacy-protection-act-ridtppa::6-48.1-5(b) to (d) | Section 6-48.1-5(b) to (d): no discrimination for exercising rights; bona fide loyalty programmes allowed |
| rhode-island-data-transparency-and-privacy-protection-act-ridtppa::6-48.1-5(e) | Section 6-48.1-5(e): access, correction, deletion, portability and three opt-outs |
| rhode-island-data-transparency-and-privacy-protection-act-ridtppa::6-48.1-5(f) and 6-48.1-6(b)(7) | Sections 6-48.1-5(f) and -6(b)(7): secure means described in the privacy notice, agents, parents and guardians |
| rhode-island-data-transparency-and-privacy-protection-act-ridtppa::6-48.1-6(b)(1) to (3) | Section 6-48.1-6(b)(1) to (3): responses within 45 days, one 45-day extension, free once a year |
| rhode-island-data-transparency-and-privacy-protection-act-ridtppa::6-48.1-6(b)(4) to (5) | Section 6-48.1-6(b)(4) and (5): authentication, fraudulent opt-outs and deleting third-party-sourced data |
| rhode-island-data-transparency-and-privacy-protection-act-ridtppa::6-48.1-6(b)(6) | Section 6-48.1-6(b)(6): an appeal process answered in writing within sixty days |
Your Compliance Coverage
If you comply with Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA), you already cover:
FTC GLBA Safeguards Rule (16 CFR Part 314)
7%
3 controls mapped
Compare →ISO/IEC 27400:2022
7%
3 controls mapped
Compare →Austria Data Protection Act (Datenschutzgesetz, DSG, amended 2018)
7%
3 controls mapped
Compare →+ 168 more: Albania Law No. 124/2024 on Personal Data Protection (7%), Switzerland New Federal Act on Data Protection (nFADP/nDSG, 2023) (7%)
See all 171 mapped frameworks ↓Maps to 171 other frameworks
Coverage is not the same as your position
This page shows what Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA) overlaps with in general. Where your organisation actually stands, against the standard you are going for and the certifications you already hold, is a different question. Same graph and the same recorded refutations, scoped to you rather than to a pair.
The Compliance Position Diagnostic, $5,000 fixed, ten business daysWhat is Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA) and who does it apply to?
Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA) is a compliance framework from United States (Rhode Island) with 4 domains and 16 controls. Rhode Island's Data Transparency and Privacy Protection Act (R.I. Gen. Laws ch. 6-48.1), effective 1 January 2026: disclosure of data categories and buyers by commercial websites and ISPs, sale and targeted advertising disclosure, security, consent for sensitive data and COPPA for children, fifteen-day consent revocation, access, correction, deletion, portability and opt-outs from targeted advertising, sale and significant profiling, 45-day responses and sixty-day appeals, processor contracts, data protection assessments, de-identified data commitments; thresholds of 35,000 customers or 10,000 with 20 percent data-sale revenue; Attorney General enforcement with no private right of action and no cure period. Built from the official statute text. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA) actually require?
Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA) has 16 controls organised across 4 domains. The largest domains are Sections 6-48.1-5 and -6: customer rights and how they are exercised – Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA) (6 controls), Section 6-48.1-4: processing of information (security, sensitive data, consent) – Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA) (4 controls), Section 6-48.1-7: controller and processor responsibilities, assessments, de-identified data, exemptions – Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA) (4 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA) do I already cover?
Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA) maps to 171 other compliance frameworks. The top mapping partners are FTC GLBA Safeguards Rule (16 CFR Part 314) (7% coverage), ISO/IEC 27400:2022 (7% coverage), Austria Data Protection Act (Datenschutzgesetz, DSG, amended 2018) (7% coverage). Use our comparison tool to explore control-level mappings between frameworks.
How do I implement Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA)?
Start your Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA) compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA) requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 16 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,120 frameworks.
Get Started Free →Free forever, no credit card required