Rhode Island Identity Theft Protection Act

The Rhode Island Identity Theft Protection Act requires businesses to notify consumers of data breaches and mandates the implementation of data security measures.

JurisdictionRhode Island
CategoryPrivacy & Data Protection
StatusActive
Latest development

Analysis

Key Requirements

The Rhode Island Identity Theft Protection Act (RIITPA) imposes several key requirements on businesses and organizations:

  • Notification of Data Breaches: Organizations must notify affected Rhode Island residents within 45 calendar days of discovering a security breach that poses a significant risk of identity theft[](https://www.riag.ri.gov/consumer-protection/identity-theft/identity-theft-protection-act-2015).
  • Implementation of Security Programs: Businesses must implement and maintain a "risk-based information security program" with reasonable security procedures appropriate to the organization's size, nature of information, and purpose of collection[](https://www.riag.ri.gov/consumer-protection/identity-theft/identity-theft-protection-act-2015).
  • Encryption of Personal Information: Personal information must be encrypted when transmitted over public networks or stored on portable devices[](https://www.securityri.com/rhode-island-identity-theft-protection-act-comply/).
  • Notification to Attorney General: For breaches affecting more than 500 Rhode Island residents, organizations must notify the Attorney General and major credit reporting agencies[](https://natlawreview.com/article/rhode-island-data-breach-law-amended-significant-changes).
  • Destruction of Personal Information: Businesses must securely destroy personal information that is no longer needed for the purpose it was collected[](https://www.securityri.com/rhode-island-identity-theft-protection-act-comply/).

Compliance Challenges

Organizations face several challenges in complying with RIITPA:

  • Implementing Adequate Security Measures: Many businesses struggle to determine what constitutes "reasonable" security procedures, especially given the rapidly evolving threat landscape[](https://www.dataprivacyandsecurityinsider.com/2024/07/rhode-islands-new-data-privacy-law/).
  • Meeting Notification Deadlines: The 45-day notification requirement can be challenging, especially for smaller organizations with limited resources[](https://www.insureon.com/small-business-insurance/cyber-liability/data-breach-laws/rhode-island).
  • Keeping Up with Evolving Definitions: The definition of "personal information" has expanded, requiring organizations to continually reassess their data protection strategies[](https://www.securityri.com/rhode-island-identity-theft-protection-act-comply/).
  • Vendor Management: Ensuring third-party vendors comply with RIITPA requirements has proven difficult, as evidenced by the 2024 RI Bridges system hack involving a state contractor.

Implementation Best Practices

To effectively implement RIITPA requirements:

  • Conduct regular risk assessments to identify vulnerabilities in data handling processes[](https://www.riag.ri.gov/consumer-protection/identity-theft/identity-theft-protection-act-2015).
  • Implement strong encryption protocols for data at rest and in transit[](https://www.securityri.com/rhode-island-identity-theft-protection-act-comply/).
  • Develop and maintain an incident response plan to ensure timely notification in case of a breach[](https://www.insureon.com/small-business-insurance/cyber-liability/data-breach-laws/rhode-island).
  • Provide regular training to employees on data protection best practices[](https://www.riag.ri.gov/consumer-protection/identity-theft/identity-theft-protection-act-2015).

Recent Updates

The most significant recent update to RIITPA was in 2024:

  • Cybersecurity Incident Reporting: State and municipal agencies must now report cybersecurity incidents to the Rhode Island State Police within 24 hours of detection[](https://natlawreview.com/article/rhode-island-data-breach-law-amended-significant-changes).
  • Notification to Collective Bargaining Agents: Agencies must notify collective bargaining agents if any affected individuals are represented by a labor union[](https://natlawreview.com/article/rhode-island-data-breach-law-amended-significant-changes).

These changes took effect upon passage of the amendment in 2024[](https://natlawreview.com/article/rhode-island-data-breach-law-amended-significant-changes).

Related Regulations

RIITPA interacts with several other regulations:

  • HIPAA: Healthcare organizations must comply with both RIITPA and HIPAA, with HIPAA often having stricter requirements[](https://www.insureon.com/small-business-insurance/cyber-liability/data-breach-laws/rhode-island).
  • CCPA and Other State Privacy Laws: Organizations operating across states must navigate the interplay between RIITPA and other state privacy laws[](https://www.dataprivacyandsecurityinsider.com/2024/07/rhode-islands-new-data-privacy-law/).
  • GDPR: For organizations handling data of EU residents, GDPR compliance often encompasses RIITPA requirements[](https://www.dataprivacyandsecurityinsider.com/2024/07/rhode-islands-new-data-privacy-law/).

Industry Impact

RIITPA has had significant impacts across industries:

  • Healthcare: The inclusion of medical information in the definition of personal information has increased compliance burdens for healthcare providers[](https://www.insureon.com/small-business-insurance/cyber-liability/data-breach-laws/rhode-island).
  • Financial Services: Banks and financial institutions face heightened scrutiny due to the sensitive nature of financial data[](https://www.securityri.com/rhode-island-identity-theft-protection-act-comply/).
  • Government Agencies: The 2024 RI Bridges system hack highlighted the vulnerabilities in public sector systems and the need for robust cybersecurity measures.

Sources

Recent developments

  • — Updated codification of **Chapter 11-49.3 – Identity Theft Protection Act of 2015** reflects the latest statutory structure and cross‑references, including the separate section on “Notification of cybersecurity incident,” reinforcing statutory expectations for timely breach notification and comprehensive risk-based information security programs for entities handling personal information.[4] (source)
  • — The most recent amendment history for **RI Gen. Laws § 11-49.3-4 (Notification of breach)** shows changes effective June 27, 2023, including detailed content requirements for breach notices (incident description, data types, dates, remediation services, and security freeze information), which continues to shape current breach‑notification practices and templates for organizations subject to the Rhode Island Identity Theft Protection Act.[2] (source)
  • — Section 11-49.3-4 maintains the requirement that notice of a breach posing significant risk of identity theft be provided in the **“most expedient time possible”** and no later than 45 days after confirmation, driving industry emphasis on faster incident investigation and response workflows to avoid statutory non‑compliance and potential enforcement.[2] (source)
  • — Senate AI and Emerging Technologies Committee approves a bill to amend the **Identity Theft Protection Act of 2015**, modernizing definitions, tightening breach reporting to the state’s Division of Enterprise Technology Strategy and Services, and requiring risk-based security programs to align with recognized cybersecurity frameworks, signaling broader compliance expectations for organizations handling Rhode Islanders’ personal data.[7] (source)
  • — The bill retains existing penalties for reckless or willful violations of the Identity Theft Protection Act but adds authority for courts to impose **additional sanctions** where warranted, increasing potential enforcement risk and prompting industry calls for clearer standards and enhanced governance around breach response and security controls.[7] (source)
  • — The modernization bill would require organizations holding Rhode Islanders’ personally identifiable information to implement risk-based security programs that conform to **recognized cybersecurity frameworks**, prompting anticipated industry moves toward formal adoption of standards such as NIST or ISO to demonstrate compliance and mitigate enforcement exposure.[7] (source)
  • — Proposed revisions to breach reporting would obligate state agencies, municipalities, and businesses to promptly report incidents to the **R.I. Division of Enterprise Technology Strategy and Services**, which industry observers expect will centralize oversight, increase coordination of incident response, and potentially lead to more consistent regulatory scrutiny of cybersecurity practices.[7] (source)
  • — New legislation (2026-H 8324A / 2026-S 3212A) targeting **business identity theft and fraudulent business filings** becomes law, complementing the Identity Theft Protection Act by creating mechanisms to remove illegitimate filings and strengthening remedies for individuals and businesses impacted by fraud, which privacy practitioners view as part of a broader tightening of Rhode Island’s anti‑fraud and identity protection framework.[5] (source)
  • — The same business identity theft law requires companies advertising paid filing services to clearly disclose that their communications are **advertisements and not government notices**, and to inform filers how to work directly with the Department of State, which industry commentators interpret as an effort to reduce deceptive practices and align with broader consumer protection and anti‑identity‑fraud goals.[5] (source)
  • — Business and legal stakeholders in Rhode Island are engaging with the new business identity theft law as part of a broader **identity protection landscape** that includes the Identity Theft Protection Act, with expectations that companies will need to strengthen internal controls around corporate filings, vendor management, and fraud monitoring to maintain compliance and protect both consumer and business identities.[5] (source)

Read the full guide to Rhode Island Identity Theft Protection Act

Related regulations

Put it into practice

Browse all regulations · Compliance deadlines · Latest updates