Data Breach Notice to Residents and State Authorities in Rhode Island

At a glance

Requirements one by one

Covered incident and person

Rhode Island's § 11-49.3-3 defines a breach by unauthorized access or acquisition of unencrypted computerized information. Section 11-49.3-4(a)(1) then requires notification for a disclosure or breach posing a significant risk of identity theft to a Rhode Island resident whose information was or is reasonably believed to have been acquired by an unauthorized person. The latter acquisition and risk conditions govern resident notice even though access alone can meet the breach definition.

The statute reaches a private person that stores, owns, collects, processes, maintains, acquires, uses, or licenses the covered data (§ 11-49.3-4(a)(1)). Section 11-49.3-3(a)(10) includes financial-access data, medical and health-insurance information, and an email address with credentials allowing access to listed accounts. It also treats hard-copy paper information as covered under the personal-information definition.

Resident and agency clocks

Private-person notice must be in the most expedient time possible and, subject to the law-enforcement route, no later than 45 calendar days after confirmation of the breach and the ability to ascertain the required notice details (§ 11-49.3-4(a)(2)(ii)). The 30-day agency clock elsewhere in subsection (a)(2) does not govern private persons.

If more than 500 Rhode Island residents are to be notified, the private person tells the attorney general and major credit-reporting agencies the timing, content and distribution of individual notices and the approximate affected count. These additional notices may not slow resident notice (§ 11-49.3-4(a)(2)(ii)).

Form and required details

Section 11-49.3-3(c) permits written notice, qualifying electronic notice, or eligible substitute notice. The individual notice lists, to the extent known, a brief account of the incident and how it occurred, affected count, information type, breach or estimated breach date or range, discovery date, offered remediation contacts, and police-report and security-freeze guidance (§ 11-49.3-4(d)).

Substitute notice requires direct-notice cost above $25,000, an affected class above 50,000, or insufficient contact information. It uses all available email, conspicuous website posting if maintained, and major statewide media (§ 11-49.3-3(c)(3)).

What trips people up

A delay requires an agency determination. Federal, state, or local law enforcement must determine notice would impede a criminal investigation. Once it says that risk has ended, the person gives notice as soon as practicable under the ordinary clock (§ 11-49.3-4(b)).

Alternate procedures have conditions. An own-policy route retains § 11-49.3-4's timing; primary or functional regulator procedures, qualifying federal financial guidelines, and the listed health-sector route are separately recognized by § 11-49.3-6.

Common questions

Does a contractor handling the data fall outside the rule?

No categorical contractor exclusion appears in the covered-person language: § 11-49.3-4(a)(1) expressly includes a person that processes or maintains the data. The statute does not create a distinct processor-to-owner notice clock.

Can a business omit facts it does not know yet from the letter?

The § 11-49.3-4(d) content list is required to the extent known. The 45-day outside clock begins after confirmation and the ability to ascertain that information.

Does an encrypted file always fall outside the breach definition?

No. Section 11-49.3-3(a)(4) says data is not considered encrypted if it is acquired together with a key, code or password permitting access.

Statutes and sources

• R.I. Gen. Laws § 11-49.3-3 — definitions and delivery methods.
• R.I. Gen. Laws § 11-49.3-4 — resident, attorney-general, and credit-agency notices.
• R.I. Gen. Laws § 11-49.3-6 — qualifying alternate procedures.

Current official Rhode Island statutes checked October 14, 2026.