Data Breach Notification Statutes – Rhode Island

Last Updated: 02/28/2024

• Applicable Statute: R.I. Gen Laws §§ 11-49.3-2 to 11-49.3-6          
• Attorney General Notice Required: Yes – must notify Attorney General if more than 500 resident are notified.
  • Timing : Notification to the attorney general shall be made without delaying notice to affected Rhode Island residents.
  • Method: Not specified (Mailing address is RI Office of the Attorney General 150 South Main Street Providence, RI 02903)
  • Content: A sample copy of the consumer notification letter must be submitted to the Attorney General, along with the approximate number of affected individuals.
• Consumer Notice Requirements:
  • Timing: Most expedient time possible but no later than 45 calendar days after confirmation of the breach and the ability to ascertain the information required to provide notice.
  • Method: Written notice; or electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in 15 U.S.C. § 7001 (E-Sign Act).
  • Content: Notification must include the following information, to the extent known:
    • A general and brief description of the incident, including how the security breach occurred and the number of affected individuals;
    • The type of information that was subject to the breach;
    • Date of breach, estimated date of breach, or the date range within which the breach occurred;
    • Date that the breach was discovered;
    • A clear and concise description of any remediation services offered, including toll free numbers and websites to contact: (i) credit reporting agencies; (ii) remediation service providers; and (iii) the Attorney General; and
    • A clear and concise description of the resident’s ability to file or obtain a police report; how a consumer requests a security freeze and the necessary information to be provided when requesting the security freeze; and that fees may be required to be paid to the consumer reporting agencies
• Consumer Reporting Agency Obligations: If more than five hundred (500) Rhode Island residents are affected, major credit reporting agencies are to be notified as to the timing, content, and distribution of the notices and the approximate number of affected individuals.
• Encryption Safe Harbor: Statute does not apply to encrypted information.
• Potential Penalties:  Violations may result in civil penalties and other remedies. Reckless violations of the statute may result in penalties up to $100 per record. Knowing and willful violations may be penalized up to $200 per record.