Rhode Island Data Transparency and Privacy Protection Act ("DTPPA")
Rhose Island became the 20th state to enact a comprhensive consumer data protection law. The Rhode Island Data Transparency and Privacy Protection Act (“DTPPA”), passed by the legislature on June 13, 2024, sets out new regulations for businesses handling personal data of state residents. It applies to for-profit entities that either control or process the personal data of at least 35,000 residents, or 10,000 residents if more than 20% of their revenue comes from data sales. The act focuses on consumer data, excluding employee or business data, and imposes requirements such as opt-in consent for processing sensitive data. It also mandates that businesses disclose their data practices, including which data is collected, who it is shared with, and provide contact information for consumers. However, it does not require universal opt-out mechanisms or data minimization. Enforcement will be carried out by the Rhode Island Attorney General, and violations will be penalized under the state's deceptive trade practice laws. The law will take effect on January 1, 2026.
