Home›Obligations›United States›By state›Rhode Island

What a Rhode Island business has to have in writing

Rhode Island bundles data security into its breach statute: the Identity Theft Protection Act makes any business holding personal information keep reasonable safeguards and a written retention and destruction practice, then notify residents within 45 days and the Attorney General once more than 500 Rhode Islanders are involved.

From January 2026 the Data Transparency and Privacy Protection Act adds a privacy notice that names the third parties a controller sells data to.

Employers with 50 or more staff must hand out a written sexual harassment policy, every employer with hazardous chemicals registers annually under the Right-to-Know law, and wage ranges must be given to applicants before pay is discussed.

Rhode Island has a rule of its own in 11 of the 14 areas, listed below. We have not checked the other 3 yet. That is not the same as Rhode Island having no rule there, and you should not read it that way. It means we have not looked.

Headcount

Industry General is always on

Ad from the publisher

Policy Acknowledgment Proof

Rhode IslandHandbook 2026acknowledged by name

Rhode Island on Recordwith AllyMatter

Cover Rhode Island the Modern WayEvery policy Rhode Island makes you write, acknowledged by name

Approve it, lock the version

Non-author approval, obsolete copies blocked

Every employee in Rhode Island on record

Who read which version, and when

Walk into any state inspection with the trail

From $29/mo, 20 editors, unlimited staff (published)

See how it works →Pricing →

Rhode Island rules for a 15–19 person general business

We check the same 14 areas of state law on every state page: breach notification, data security program, consumer privacy law, biometric and health data, harassment prevention, workplace safety programs, workplace violence prevention, insurance data security, state vendor security program, paid leave policies, required postings, pay transparency, licensing and certifications, and other written policies. Federal rules apply in most of these already. What this page adds is whether Rhode Island has a rule of its own on top. The federal rules every employer carries follow the Rhode Island rules. Each row names what you must write, post, file or certify, who enforces it, and links to the authority.

Breach Notification 1Who you must tell after a data breach, and how fast

LawProduceWhat it requiresTriggerEnforced by

Rhode Island Identity Theft Protection Act of 2015R.I. Gen. Laws chapter 11-49.3 #Any municipal agency, state agency or person that stores, collects, processes, maintains, acquires, uses, owns or licenses personal information about a Rhode Island residentDistribute + ack

Notice

Notify affected Rhode Island residents in writing within 45 days of confirming a breach, describing what happened, what data was involved and what the business is doing about it. When more than 500 residents must be notified, tell the Attorney General and the major credit reporting agencies the timing, content, distribution and approximate number affected, without holding up the consumer notices.

From the first employee

Rhode Island Attorney General (exclusive enforcement)

AuthorityRhode Island Attorney General - Data Breach Notifications Rhode Island General Assembly - Chapter 11-49.3 Rhode Island Attorney General - Consumer Protection Unit Report an error

Data Security Program 1A written safeguards program the state requires before anything goes wrong

LawProduceWhat it requiresTriggerEnforced by

Duty to protect personal information (Identity Theft Protection Act)R.I. Gen. Laws § 11-49.3-2 #Any business or agency that holds personal information about a Rhode Island resident, whether or not it does business in the stateWrite

Written program

Maintain a risk-based information security program with reasonable administrative, technical and physical safeguards for the personal information held, keep that data only as long as there is a business or legal reason for it, destroy it securely afterwards, and put the same duties on service providers by contract.

From the first employee

Rhode Island Attorney General

AuthorityRhode Island General Assembly - Chapter 11-49.3 Rhode Island Attorney General - Data Breach Notifications Report an error

Consumer Privacy Law 1Rights, notices and assessments for consumer data

LawProduceWhat it requiresTriggerEnforced by

Rhode Island Data Transparency and Privacy Protection ActR.I. Gen. Laws chapter 6-48.1 (2024-H 7787 / S 2500), effective January 1, 2026 #For-profit entities doing business in Rhode Island or targeting Rhode Islanders that in a year control or process personal data of 35,000+ customers, or 10,000+ customers while earning more than 20% of gross revenue from selling personal data; the website disclosure duty reaches commercial websites and internet service providers more broadlyWrite

Written policy

Publish a privacy notice that lists the categories of personal data collected and disclosed, the purposes, and - unusually for a state privacy law - names all third parties to whom the data has been or may be sold. Get opt-in consent before processing sensitive data, offer a way to give and withdraw consent, document data protection assessments for higher-risk processing, and honor access, correction, deletion, portability and opt-out requests.

From the first employee

Rhode Island Attorney General

AuthorityRhode Island General Assembly - Chapter 6-48.1 Rhode Island Attorney General - Consumer Protection Unit Report an error

Harassment Prevention 1A written policy, and in some states annual training, on harassment

LawProduceWhat it requiresTriggerEnforced by

Sexual Harassment, Education and Training in the Workplace ActR.I. Gen. Laws § 28-51-2 #Employers with 50 or more employeesWrite

Written policy

Adopt a written policy against sexual harassment that defines it with examples, states that retaliation for complaining or cooperating is unlawful, sets out the range of consequences, explains the internal complaint route with the names, work addresses and phone numbers of the people who take complaints, and identifies the state and federal enforcement agencies. Give a copy to every employee, including each new hire on day one, keep copies on the premises and hand them to an enforcement agency on request.

50+ employees

Rhode Island Commission for Human Rights; Rhode Island Department of Labor and Training (posting)

AuthorityRhode Island General Assembly - Chapter 28-51 Rhode Island DLT - Required Posters for the Workplace Report an error

Workplace Safety Programs 1Written programs the state safety agency requires beyond federal OSHA

LawProduceWhat it requiresTriggerEnforced by

Hazardous Substances Right-to-Know ActR.I. Gen. Laws chapter 28-21 #Any employer with at least one full- or part-time employee that keeps more than 2 gallons or 10 pounds of a designated hazardous substance, or a product containing 1% or more of a carcinogenWrite

Written program

File the annual Right-to-Know registration with the Department of Labor and Training, obtain safety data sheets from suppliers, keep an alphabetical chemical identification list cross-referenced to chemical names and available to employees during all operating hours, label containers, train employees each year, and submit documentation of that training. Rhode Island has no OSHA-approved state plan, so federal OSHA covers general workplace safety.

From the first employee

Rhode Island Department of Labor and Training, Occupational Safety Unit

AuthorityRhode Island DLT - Right to Know Guidelines for Employers Rhode Island DLT - Right-to-Know Law brochure Rhode Island General Assembly - Chapter 28-21 Report an error

Paid Leave Policies 1Sick and family leave laws that come with a written policy or notice

LawProduceWhat it requiresTriggerEnforced by

Healthy and Safe Families and Workplaces ActR.I. Gen. Laws chapter 28-57 #Every Rhode Island employer; leave is paid at 18 or more employees and unpaid below thatWrite

Written policy

Let employees accrue at least one hour of sick and safe leave for every 35 hours worked, up to 40 hours a year, or front-load the 40 hours. Put the accrual, carryover and notice rules in a written policy, tell employees what they have accrued, and display the DLT notice covering the law.

From the first employee

Rhode Island Department of Labor and Training, Labor Standards Unit

AuthorityRhode Island DLT - Paid Sick and Safe Leave Rhode Island DLT - Required Posters for the Workplace Rhode Island DLT - Labor Standards Report an error

Required Postings 1The notices every workplace in the state must display

LawProduceWhat it requiresTriggerEnforced by

Required workplace postersVarious (R.I. Gen. Laws chapters 28-5, 28-12, 28-14, 28-21, 28-33, 28-41, 28-48, 28-51, 28-57) #Every Rhode Island employer, at each worksitePost

Posting

Display the DLT combination poster and the separate state notices where employees can read them: minimum wage and wage payment, sick and safe leave, parental and family medical leave, temporary disability and caregiver insurance, unemployment, workers' compensation, child labor, Right-to-Know, pregnancy accommodation, no-smoking and sexual harassment. Remote workers may be sent the DLT poster page instead.

From the first employee

Rhode Island Department of Labor and Training

AuthorityRhode Island DLT - Required Posters for the Workplace Rhode Island DLT - Labor Standards Report an error

Pay Transparency 1Salary ranges in job posts and pay disclosure on request

LawProduceWhat it requiresTriggerEnforced by

Rhode Island Pay Equity Act wage range disclosureAccessed and verified 2026-10-07R.I. Gen. Laws § 28-6-22 (P.L. 2021, chs. 168 and 169), effective January 1, 2023 #Every Rhode Island employer, with no employee-count thresholdDistribute

Notice

Give an applicant the wage range for the position on request, and give an employee the range at hire, when they move into a new position and whenever they ask; the law adds that an applicant should get the range before pay is discussed. Do not seek an applicant's wage history or rely on it in deciding whether to consider the applicant or what to pay, except that after an initial offer a history the applicant volunteered may be used to support a higher wage. Do not refuse to interview, hire, promote or employ anyone, or retaliate, for withholding wage history or asking for the range.

From the first employee

Rhode Island Department of Labor and Training (complaint to the Director); civil action by an employee

AuthorityRhode Island DLT - Pay Equity Act Rhode Island General Assembly - R.I. Gen. Laws § 28-6-22 Rhode Island DLT - Pay Equity Act guidance Report an error

Licensing and Certifications 1Registrations, licenses and certifications a business or its staff must hold

LawProduceWhat it requiresTriggerEnforced by

Business registration (Secretary of State Business Services Division)R.I. Gen. Laws title 7 (business corporations, LLCs, partnerships); R.I. Gen. Laws § 6-1-1 (fictitious names) #Corporations, LLCs, limited partnerships, nonprofits and out-of-state entities transacting business in Rhode IslandFile

Filing / record

File formation or foreign qualification documents with the Business Services Division, name a resident agent with a Rhode Island address, and file the annual report in the window the statute sets for the entity type. Rhode Island has no single statewide general business license, so trade-specific licenses and local permits are separate.

From the first employee

Rhode Island Department of State, Business Services Division

AuthorityRhode Island Department of State - Business Services Rhode Island Department of State - Rules and Regulations Report an error

Because You Are in Construction 1Industry layer

LawProduceWhat it requiresTriggerEnforced by

Contractor registration and licensingR.I. Gen. Laws chapter 5-65; 440-RICR-10-00-2 #Contractors, remodelers and most subcontractors building or repairing residential or commercial structures in Rhode IslandFile

Filing / record

Register with the Contractors' Registration and Licensing Board before bidding or working, showing a state-approved five-hour pre-registration course (waived for purely commercial work), at least $500,000 general liability coverage and workers' compensation coverage if you have employees, both naming the Board as certificate holder. Keep the registration number on contracts and advertising and renew it on the Board's cycle.

From the first employee

Rhode Island Contractors' Registration and Licensing Board

AuthorityRhode Island Contractors' Registration and Licensing Board - Contractor FAQs Rhode Island CRLB - Apply for general contractor registration Rhode Island Department of State - Registration of Contractors (440-RICR-10-00-2)Report an error

Because You Are in Food & Beverage 1Industry layer

LawProduceWhat it requiresTriggerEnforced by

Food service licensing and certified manager in food safetyR.I. Gen. Laws chapter 21-27; 216-RICR-50-10-2 #Food establishments licensed by the Department of Health that prepare time and temperature control for safety foodsCertify

Certification

Hold and renew the Department of Health food service license, and keep at least one certified manager in food safety on site during all hours of operation - two when more than ten employees prepare food. Certificates hang next to the license in public view, and certification rests on an approved course and proctored exam taken within three years of applying.

From the first employee

Rhode Island Department of Health, Center for Food Protection

AuthorityRhode Island Department of Health - Food Service Rhode Island Department of Health - Food Safety Managers Rhode Island Department of State - Certification of Managers in Food Safety (216-RICR-50-10-2)Report an error

Because You Are in Financial & Tax 1Industry layer

LawProduceWhat it requiresTriggerEnforced by

Rhode Island Insurance Data Security ActP.L. 2022 (2022-H 7281 / S 2744), effective January 1, 2025; 230-RICR-20-60-8 (safeguarding customer information) #Insurance licensees of the Department of Business Regulation, domestic and foreign, that hold nonpublic informationCertify

Certification

Build a written information security program on a documented risk assessment, oversee third-party service providers, investigate cybersecurity events and notify the Insurance Commissioner, and - for Rhode Island-domiciled licensees - file an annual certification of compliance by April 15 and keep the supporting records for five years. A domestic licensee already meeting HIPAA and HITECH may certify on the strength of that program.

From the first employee

Rhode Island Department of Business Regulation, Insurance Division

AuthorityRhode Island DBR - Insurance Bulletin 2025-1 Insurance Data Security Rhode Island Department of State - Standards for Safeguarding Customer Information (230-RICR-20-60-8)Rhode Island General Assembly - 2022 S 2744 Report an error

From the publisher

Keep Your Written Policies in One Place

Whatever you are working toward, AllyMatter gets your policies approved, keeps every version and records who has read each one.

See how AllyMatter works ↗From $29/mo, 20 editors, unlimited staff

Your business type, with Rhode Island on top

Need a hand implementing it?

Find a Consultant Who Does This Work

Tell us what you need done and we will point you to firms that do this work. Your details go to a firm only when you choose it.

Get help →Advertise Here

Sources

Rhode Island Attorney General - Data Breach NotificationsRhode Island General Assembly - Chapter 11-49.3Rhode Island Attorney General - Consumer Protection UnitRhode Island General Assembly - Chapter 6-48.1Rhode Island General Assembly - Chapter 28-51Rhode Island DLT - Required Posters for the WorkplaceRhode Island DLT - Right to Know Guidelines for EmployersRhode Island DLT - Right-to-Know Law brochureRhode Island General Assembly - Chapter 28-21Rhode Island DBR - Insurance Bulletin 2025-1 Insurance Data SecurityRhode Island Department of State - Standards for Safeguarding Customer Information (230-RICR-20-60-8)Rhode Island General Assembly - 2022 S 2744Rhode Island DLT - Paid Sick and Safe LeaveRhode Island DLT - Labor StandardsRhode Island DLT - Pay Equity ActRhode Island General Assembly - R.I. Gen. Laws § 28-6-22Rhode Island DLT - Pay Equity Act guidanceRhode Island Department of State - Business ServicesRhode Island Department of State - Rules and RegulationsRhode Island Contractors' Registration and Licensing Board - Contractor FAQsRhode Island CRLB - Apply for general contractor registrationRhode Island Department of State - Registration of Contractors (440-RICR-10-00-2)Rhode Island Department of Health - Food ServiceRhode Island Department of Health - Food Safety ManagersRhode Island Department of State - Certification of Managers in Food Safety (216-RICR-50-10-2)Rhode Island General Assembly - Chapter 28-59

What a Rhode Island business has to have in writing

Headcount

Industry General is always on

Rhode Island rules for a 15–19 person general business

Breach Notification 1Who you must tell after a data breach, and how fast

Data Security Program 1A written safeguards program the state requires before anything goes wrong

Consumer Privacy Law 1Rights, notices and assessments for consumer data

Harassment Prevention 1A written policy, and in some states annual training, on harassment

Workplace Safety Programs 1Written programs the state safety agency requires beyond federal OSHA

Paid Leave Policies 1Sick and family leave laws that come with a written policy or notice

Required Postings 1The notices every workplace in the state must display

Pay Transparency 1Salary ranges in job posts and pay disclosure on request

Licensing and Certifications 1Registrations, licenses and certifications a business or its staff must hold

Other Written Policies 1Any other document the state makes an employer write or hand out

Because You Are in Construction 1Industry layer

Because You Are in Food & Beverage 1Industry layer

Because You Are in Financial & Tax 1Industry layer

Federal rules for a 15–19 person general business

Keep Your Written Policies in One Place

Your business type, with Rhode Island on top

For another state

Find a Consultant Who Does This Work

Sources

About this data

Think something is wrong?

Want to advertise here?