Title 6
Commercial Law — General Regulatory Provisions

Chapter 48.1
Rhode Island Data Transparency and Privacy Protection Act [Effective January 1, 2026.]

§ 6-48.1-5. Customer rights. [Effective January 1, 2026.]

(a) This section shall apply to for-profit entities that conduct business in the state or for-profit entities that produce products or services that are targeted to residents of the state and that during the preceding calendar year did any of the following:

(1) Controlled or processed the personal data of not less than thirty-five thousand (35,000) customers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction.

(2) Controlled or processed the personal data of not less than ten thousand (10,000) customers and derived more than twenty percent (20%) of their gross revenue from the sale of personal data.

(b) No controller shall discriminate against a customer for exercising their customer rights.

(c) No controller shall deny goods or services, charge different prices or rates for goods or services, or provide a different level of quality of goods or services to the customer if the customer opts out to use of their data. However, if a customer opts out of data collection, the covered entity is not required to provide a service that requires this data collection.

(d) Controllers may provide different prices and levels for goods and services if it is for a bona fide loyalty, rewards, premium features, discount, or club card programs in which customers voluntarily participate.

(e) A customer shall have the right to:

(1) Confirm whether or not a controller is processing the customer’s personal data and access such personal data, unless such confirmation or access would require the controller to reveal a trade secret;

(2) Correct inaccuracies in the customer’s personal data and delete personal data provided by, or obtained about, the customer, taking into account the nature of the personal data and the purposes of the processing of the customer’s personal data;

(3) Obtain a copy of the customer’s personal data processed by the controller, in a portable and, to the extent technically feasible, readily usable format that allows the customer to transmit the data to another controller without undue delay, where the processing is carried out by automated means; provided such controller shall not be required to reveal any trade secret; and

(4) Opt out of the processing of the personal data for purposes of targeted advertising, the sale of personal data, or profiling in furtherance of solely automated decisions that produce legal or similarly significant effects concerning the customer.

(f) A customer may exercise rights under this section by secure and reliable means established by the controller and described to the customer in the controller’s privacy notice. A customer may designate an authorized agent to exercise the rights to opt out on their behalf. In the case of processing personal data of a known child, the parent or legal guardian may exercise such customer rights on the child’s behalf. In the case of processing personal data concerning a customer subject to a guardianship, conservatorship, or other protective arrangement, the guardian or the conservator of the customer may exercise such rights on the customer’s behalf.