Data breach notification
Rhode Island's Identity Theft Protection Act of 2015 sits in R.I. Gen. Laws chapter 11-49.3, with the notice duty at § 11-49.3-4.
Notice is owed for a breach "that poses a significant risk of identity theft to any resident of Rhode Island whose personal information was, or is reasonably believed to have been, acquired by an unauthorized person or entity."
That wording builds the risk assessment into the duty itself. A breach that poses no significant risk of identity theft falls outside it.
| Point | Rhode Island |
|---|---|
| Deadline to residents | No later than 45 calendar days after confirmation of the breach and the ability to ascertain the information the notice needs |
| Agencies | State and municipal agencies have 30 days |
| Regulator | The attorney general, plus the major credit reporting agencies |
| When the regulator is told | When more than 500 Rhode Island residents are to be notified |
| Encrypted data | Outside the definition when encrypted with a 128-bit or higher process |
The resident clock is written as "in the most expedient time possible" and "no later than forty-five (45) calendar days after confirmation of the breach and the ability to ascertain the information required to fulfill the notice requirements". It starts at confirmation, not at the first sign of trouble.
The definition pairs a first name or first initial and last name with one or more data elements, "when the name and the data elements are not encrypted or are in hard copy, paper format."
Paper is therefore inside the law, not only computer files.
The elements are a Social Security number; a driver's license, Rhode Island identification card or tribal identification number; an account or card number with any required code, password or PIN; medical or health insurance information; and an email address with any required security code, access code or password for a personal, medical, insurance or financial account.
Encryption only counts when it is 128-bit or higher, producing a form with "a low probability of assigning meaning without use of a confidential process or key."
For documents you share through ShareAndGo, the activity log records every view and download, and watermarked view-only pages carry the reader's email address and the date.
In Providence or Warwick, a team sending a client's health insurance papers to an adviser can put them in a room the adviser opens after confirming a six-digit code sent to their email, with no account to create.
The per-viewer watermark is a per-room setting, on by default. The log is chained, each entry linked to the one before it, and it exports as CSV for anyone reconstructing which files a person opened inside ShareAndGo.
Checked against Rhode Island's published law on November 2, 2026. This is general information, not legal advice.
