Title 6
Commercial Law — General Regulatory Provisions

Chapter 48.1
Rhode Island Data Transparency and Privacy Protection Act [Effective January 1, 2026.]

§ 6-48.1-6. Exercising customer rights. [Effective January 1, 2026.]

(a) This section shall apply to for-profit entities that conduct business in the state or for-profit entities that produce products or services that are targeted to residents of the state and that during the preceding calendar year did any of the following:

(1) Controlled or processed the personal data of not less than thirty-five thousand (35,000) customers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction.

(2) Controlled or processed the personal data of not less than ten thousand (10,000) customers and derived more than twenty percent (20%) of their gross revenue from the sale of personal data.

(b) A controller shall comply with a request by a customer to exercise the customer rights authorized as follows:

(1) A controller shall respond to the customer without undue delay, but not later than forty-five (45) days after receipt of the request. The controller may extend the response period by forty-five (45) additional days when reasonably necessary, considering the complexity and number of the customer’s requests; provided the controller informs the customer of any such extension within the initial forty-five (45) day response period and of the reason for the extension.

(2) If a controller declines to act regarding the customer’s request, the controller shall inform the customer without undue delay, but not later than forty-five (45) days after receipt of the request, of the justification for declining to act and instructions for how to appeal the decision.

(3) Information provided in response to a customer request shall be provided by a controller, free of charge, once per customer during any twelve-month (12) period. If requests from a customer are manifestly unfounded, excessive, or repetitive, the controller may charge the customer a reasonable fee to cover the administrative costs of complying with the request or decline to act on the request. The controller bears the burden of demonstrating the manifestly unfounded, excessive, or repetitive nature of the request.

(4) If a controller is unable to authenticate a request to exercise any of the rights afforded, the controller shall not be required to comply with a request to initiate an action pursuant to this section and shall provide notice to the customer that the controller is unable to authenticate the request to exercise such right or rights until such customer provides additional information reasonably necessary to authenticate such customer and such customer’s request to exercise such right or rights. A controller shall not be required to authenticate an opt-out request, but may deny an opt-out request if the controller has reasonable and documented belief that such request is fraudulent. If a controller denies an opt-out request because the controller believes such request is fraudulent, the controller shall send a notice to the person who made such request disclosing that such controller believes such request is fraudulent, why such controller believes such request is fraudulent, and that such controller shall not comply with such request.

(5) A controller that has obtained personal data about a customer from a source other than the customer shall be deemed in compliance with a customer’s request to delete such data by doing the following:

(i) Retaining a record of the deletion request and the minimum data necessary for the purpose of ensuring the customer’s personal data remains deleted from the controller’s records and not using such retained data for any other purpose pursuant to the provisions of this chapter; or

(ii) Opting the customer out of the processing of such personal data for any purpose except for those exempted pursuant to the provisions of this chapter.

(6) A controller shall establish a process for a customer to appeal the controller’s refusal to take action on a request within a reasonable period of time after the customer’s receipt of the decision. The appeal process shall be clearly and conspicuously available. Not later than sixty (60) days after receipt of an appeal, a controller shall inform the customer in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decision. If the appeal is denied, the customer may submit a complaint to the attorney general.

(7) A customer may designate another person to serve as the customer’s authorized agent and act on such customer’s behalf, to opt out of the processing of such customer’s personal data. A controller shall comply with an opt-out request received from an authorized agent if the controller is able to verify the identity of the customer and the authorized agent’s authority to act on the customer’s behalf.