1. Home
  2. State breach laws
  3. Rhode Island

Rhode Island data breach notification law

What Rhode Island requires when personal information is exposed: how fast residents must be notified, when the Attorney General has to be told, what it costs to get it wrong, and whether affected people can sue. Governed by R.I. Gen. Laws § 11-49.3-1 et seq. (Identity Theft Protection Act of 2015), notice requirements at § 11-49.3-4 and penalties at § 11-49.3-5.

45 days
Notification deadline
Required
AG notification
No
Private right of action
None
Liability protection

What this means if you sell security services

Rhode Island's 45-day notification window means filings surface while remediation is still underway and the organization is still deciding what to change. Attorney General notice is required, and that filing is what puts the incident on the public record RiversideIQ tracks. The law itself gives individuals no right to sue, so the conversation centers on regulator penalties and remediation rather than lawsuits.

See recent Rhode Island breach filings →

Requirements in detail

Statute
R.I. Gen. Laws § 11-49.3-1 et seq. (Identity Theft Protection Act of 2015), notice requirements at § 11-49.3-4 and penalties at § 11-49.3-5
Deadline to notify residents
In the most expedient time possible, and no later than 45 calendar days after confirming the breach and being able to gather the information required for the notice. State and municipal agencies have 30 calendar days. Notice may be delayed if law enforcement determines it would impede a criminal investigation.
Attorney General notification
Yes, when more than 500 Rhode Island residents are to be notified, the Attorney General and the major consumer reporting agencies must be told the timing, content, and distribution of the notices and the approximate number of people affected. This notice must not delay notice to residents. Government employers must also notify the union representing affected employees.
Penalties
Civil penalties of up to $100 per record for each reckless violation and up to $200 per record for each knowing and willful violation. The Attorney General enforces the law.
Private right of action
No. The breach notification law itself doesn't give individuals a right to sue; the Attorney General enforces it. People can still bring other claims after a breach, such as negligence.
Encryption exemption
Rhode Island's notification requirements apply to unencrypted personal information. Encrypted data generally doesn't trigger notice unless the encryption key or credentials were also compromised.
Liability protection for security programs
None. Rhode Island has no law limiting breach lawsuits for organizations that maintain a security program.

Rhode Island breach notification FAQ

What is the data breach notification deadline in Rhode Island?

In the most expedient time possible, and no later than 45 calendar days after confirming the breach and being able to gather the information required for the notice. State and municipal agencies have 30 calendar days. Notice may be delayed if law enforcement determines it would impede a criminal investigation. The governing law is R.I. Gen. Laws § 11-49.3-1 et seq. (Identity Theft Protection Act of 2015), notice requirements at § 11-49.3-4 and penalties at § 11-49.3-5.

Does Rhode Island require notifying the Attorney General of a data breach?

Yes, when more than 500 Rhode Island residents are to be notified, the Attorney General and the major consumer reporting agencies must be told the timing, content, and distribution of the notices and the approximate number of people affected. This notice must not delay notice to residents. Government employers must also notify the union representing affected employees.

What are the penalties for failing to report a data breach in Rhode Island?

Civil penalties of up to $100 per record for each reckless violation and up to $200 per record for each knowing and willful violation. The Attorney General enforces the law.

Can individuals sue over a data breach in Rhode Island?

No. The breach notification law itself doesn't give individuals a right to sue; the Attorney General enforces it. People can still bring other claims after a breach, such as negligence.

Does encrypted data need to be reported in Rhode Island?

Rhode Island's notification requirements apply to unencrypted personal information. Encrypted data generally doesn't trigger notice unless the encryption key or credentials were also compromised.

Does Rhode Island limit breach lawsuits for companies with a cybersecurity program?

No. Rhode Island has no law limiting breach lawsuits for organizations that maintain a security program.

Last reviewed October 5, 2026. This summary is for general information and is not legal advice. Statutes change; confirm current requirements with counsel or the Rhode Island Attorney General before relying on them.

Other states with a 45-day deadline

Breach notification laws by state

Compare all 51 jurisdictions on the interactive map →·US data breach statistics →