{
 "jurisdiction_id": "US-RI",
 "jurisdiction": "United States – Rhode Island",
 "url": "https://dataprotection.gi/jurisdictions/united-states-rhode-island/",
 "generator": "render_jid v13-gdpri-1.0.0",
 "date_modified": "2026-08-06",
 "schema_version": "gdpri-v2",
 "counts": {
  "categories": 10,
  "claims": 36,
  "sub_modules": 57,
  "source_register": 13
 },
 "categories": [
  {
   "code": "regulator_and_framework",
   "name": "Regulator & Framework",
   "traffic_light": "amber",
   "sub_modules": [
    "act_and_instruments",
    "material_scope",
    "regulator_and_authority",
    "regulator_registration_and_filing",
    "territorial_scope"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-rhode-island/#regulator-and-framework-regulator-framework",
   "traffic_light_rationale": "Core statute is in force and enforceable, but coverage gaps (no ROPA duty, no DPO rule, no in-statute breach-notification provision, no cure right) leave material compliance ambiguity relative to peer state laws.",
   "claims": [
    {
     "statement": "The Rhode Island Attorney General has sole enforcement authority over RIDTPPA and may enforce violations pursuant to RIDTPPA or the general regulatory provisions of Title 6 commercial law.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://legacy.dataguidance.com/notes/rhode-island-data-protection-overview",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "The Governor of Rhode Island transmitted the RIDTPPA without signature on June 25, 2024, and it entered into effect on January 1, 2026.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://www.dataguidance.com/jurisdictions/rhode-island",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "RIDTPPA applies to entities that control or process the personal information of more than 35,000 Rhode Island residents, or more than 10,000 residents while generating 20% of gross revenue from personal data sales.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "International Association of Privacy Professionals",
     "source_url": "https://iapp.org/news/a/omissions-misalignment-raise-questions-with-rhode-island-s-comprehensive-privacy-bill",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "A 'customer' under RIDTPPA is defined as an individual residing in Rhode Island in an individual or household context, excluding individuals acting in a commercial or employment context.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://legacy.dataguidance.com/notes/rhode-island-data-protection-overview",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "Information contained in a data protection assessment disclosed to the Attorney General does not waive attorney-client privilege or work-product protection over that content.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Probable",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://legacy.dataguidance.com/notes/rhode-island-data-protection-overview",
     "source_tier": null,
     "observed_at": "2026-08-06"
    }
   ]
  },
  {
   "code": "lawful_processing_and_special_data",
   "name": "Lawful Processing & Special Data",
   "traffic_light": "amber",
   "sub_modules": [
    "consent_thresholds",
    "lawful_bases",
    "pseudonymisation_and_anonymisation",
    "special_categories"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-rhode-island/#lawful-processing-and-special-data-lawful-processing-special-data",
   "traffic_light_rationale": "Consent and sensitive-data protections exist but the pseudonymous-data carve-out and absence of enumerated lawful bases create materially weaker protection than GDPR-aligned regimes.",
   "claims": [
    {
     "statement": "RIDTPPA shall not be construed to prevent a controller from providing a product or service specifically requested by a customer, performing under a contract to which a customer is a party, or taking steps at a customer's request prior to entering into a contract.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://legacy.dataguidance.com/notes/rhode-island-data-protection-overview",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "Consent under RIDTPPA is defined as a clear, affirmative act signifying a customer's freely given, specific, informed and unambiguous agreement to processing of personal data.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://legacy.dataguidance.com/notes/rhode-island-data-protection-overview",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "A controller must provide a mechanism to grant and revoke consent and, upon receipt of a revocation, must suspend processing as soon as practicable and no later than 15 days from receipt.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://legacy.dataguidance.com/notes/rhode-island-data-protection-overview",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "A controller shall not process sensitive data of a known child unless consent is obtained and the information is processed in accordance with COPPA; controllers compliant with COPPA's verifiable parental consent requirements are deemed compliant with RIDTPPA's parental consent obligation.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://legacy.dataguidance.com/notes/rhode-island-data-protection-overview",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "Personal data under RIDTPPA is defined as information linked or reasonably linkable to an identified or identifiable individual and does not include de-identified data or publicly available information.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://legacy.dataguidance.com/notes/rhode-island-data-protection-overview",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "Consumer advocates raised concerns that RIDTPPA's exemption of pseudonymous data from opt-outs and access requests allows continued use of mobile ad IDs and IP addresses for granular tracking and profile sales.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Probable",
     "source_publisher": "International Association of Privacy Professionals",
     "source_url": "https://iapp.org/news/a/omissions-misalignment-raise-questions-with-rhode-island-s-comprehensive-privacy-bill",
     "source_tier": null,
     "observed_at": "2026-08-06"
    }
   ]
  },
  {
   "code": "data_subject_rights",
   "name": "Data Subject Rights",
   "traffic_light": "amber",
   "sub_modules": [
    "access_right",
    "data_portability",
    "deadlines_and_response_windows",
    "rectification_and_erasure",
    "restriction_and_objection"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-rhode-island/#data-subject-rights-data-subject-rights",
   "traffic_light_rationale": "Core rights are present and in force, but response-deadline mechanics and appeal procedures were not confirmed in the sources reviewed, creating an operational ambiguity for controllers.",
   "claims": [
    {
     "statement": "RIDTPPA details data subject rights including the right to be informed, access, rectification, deletion, and data portability.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://www.dataguidance.com/jurisdictions/rhode-island",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "RIDTPPA provides customers the right to opt out of processing for targeted advertising, profiling, or profiling in furtherance of solely automated decisions that produce legal or similarly significant effects concerning the customer.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://www.dataguidance.com/jurisdictions/rhode-island",
     "source_tier": null,
     "observed_at": "2026-08-06"
    }
   ]
  },
  {
   "code": "controller_processor_duties",
   "name": "Controller/Processor Duties",
   "traffic_light": "amber",
   "sub_modules": [
    "accountability_and_dpia",
    "breach_notification",
    "dpo_requirements",
    "joint_controller_arrangements",
    "retention_and_disposal",
    "ropa_requirements",
    "security_measures"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-rhode-island/#controller-processor-duties-controller-processor-duties",
   "traffic_light_rationale": "DPIA and processor-contract duties are in force and material, but the explicit absence of ROPA and DPO obligations, plus reliance on a separate statute for breach notification, represents a materially incomplete accountability framework relative to GDPR-aligned regimes.",
   "claims": [
    {
     "statement": "A controller shall conduct and document a data protection assessment for each processing activity that presents a heightened risk of harm to a customer, including processing for targeted advertising, sale of personal data, and certain profiling.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://legacy.dataguidance.com/notes/rhode-island-data-protection-overview",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "Data protection assessment requirements apply only to processing activities created or generated after January 1, 2026, and are not retroactive.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://legacy.dataguidance.com/notes/rhode-island-data-protection-overview",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "RIDTPPA does not specifically address data protection officer appointments.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Confirmed",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://legacy.dataguidance.com/notes/rhode-island-data-protection-overview",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "RIDTPPA does not oblige controllers or processors to create and maintain data processing records.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Confirmed",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://legacy.dataguidance.com/notes/rhode-island-data-protection-overview",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "Processor contracts must require confidentiality, deletion or return of personal data at the end of services, cooperation with controller compliance demonstrations, and written flow-down of processor obligations to subcontractors after the controller is given an opportunity to object.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://legacy.dataguidance.com/notes/rhode-island-data-protection-overview",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "RIDTPPA establishes obligations for controllers and processors to establish, implement, and maintain reasonable administrative, technical, and physical data security practices.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://www.dataguidance.com/jurisdictions/rhode-island",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "Under the Rhode Island Identity Theft Protection Act of 2015, any person that stores, owns, collects, processes, maintains, acquires, uses, or licenses data including personal information must notify affected consumers, the Attorney General, and consumer reporting agencies if more than 500 consumers may have been affected by a breach.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://www.dataguidance.com/jurisdictions/rhode-island",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "The Rhode Island Attorney General's Office must be notified within 45 days any time a data breach results in personal data of more than 500 Rhode Islanders being exposed.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "State of Rhode Island",
     "source_url": "https://riag.ri.gov/press-releases/attorney-general-neronha-offers-information-how-protect-yourself-following-data",
     "source_tier": null,
     "observed_at": "2026-08-06"
    }
   ]
  },
  {
   "code": "cross_border_and_adequacy",
   "name": "Cross-Border & Adequacy",
   "traffic_light": "red",
   "sub_modules": [
    "adequacy_granted",
    "adequacy_received",
    "data_localisation",
    "sccs_and_bcrs",
    "transfer_impact_assessment",
    "transfer_mechanisms"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-rhode-island/#cross-border-and-adequacy-cross-border-adequacy",
   "traffic_light_rationale": "No comprehensive cross-border transfer regime exists under RIDTPPA or any identified Rhode Island sectoral statute; this is a genuine regulatory gap rather than a research omission.",
   "claims": []
  },
  {
   "code": "sectoral_watch",
   "name": "Sectoral Watch",
   "traffic_light": "amber",
   "sub_modules": [
    "credit_and_scoring",
    "education",
    "employment_data",
    "financial_sector_overlay",
    "health_sector_overlay",
    "insurance",
    "telecoms_and_eprivacy"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-rhode-island/#sectoral-watch-sectoral-watch",
   "traffic_light_rationale": "Employment carve-out is confirmed; federal sectoral overlays are well-established but RIDTPPA-specific entity-level exemptions for HIPAA/GLBA-covered entities could not be independently confirmed from the sources reviewed.",
   "claims": [
    {
     "statement": "Under Title V of the Gramm-Leach-Bliley Act, each financial institution has an affirmative and continuing obligation to respect customer privacy and protect the security and confidentiality of nonpublic personal information.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "Federal Trade Commission",
     "source_url": "https://www.ftc.gov/business-guidance/resources/how-comply-privacy-consumer-financial-information-rule-gramm-leach-bliley-act",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "Rhode Island House Bill 5857 would mandate health data privacy policies and consumer rights for regulated entities and small businesses by 2026, but its enactment status was not confirmed.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Uncertain",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://www.dataguidance.com/jurisdictions/rhode-island",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "The RIDTPPA definition of 'customer' excludes individuals acting in a commercial or employment context, including employees, owners, directors, officers, or contractors of a company, partnership, sole proprietorship, nonprofit, or government agency, whose communications occur solely within that role.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://legacy.dataguidance.com/notes/rhode-island-data-protection-overview",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "The Rhode Island Attorney General joined a coalition of 17 attorneys general challenging expanded federal IPEDS survey data demands on colleges and universities, arguing the requirements jeopardize student privacy.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Confirmed",
     "source_publisher": "State of Rhode Island",
     "source_url": "https://riag.ri.gov/press-releases/attorney-general-neronha-coalition-sue-stop-unlawful-data-demand-colleges-and",
     "source_tier": null,
     "observed_at": "2026-08-06"
    }
   ]
  },
  {
   "code": "adtech_and_commercial_privacy",
   "name": "AdTech & Commercial Privacy",
   "traffic_light": "amber",
   "sub_modules": [
    "clean_rooms_and_dcr",
    "cookies_and_trackers",
    "cross_context_advertising",
    "dark_patterns",
    "direct_marketing",
    "opt_out_signals"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-rhode-island/#adtech-and-commercial-privacy-adtech-commercial-privacy",
   "traffic_light_rationale": "Core opt-out right for targeted advertising/sale exists and is in force, but the absence of universal opt-out signal recognition and unconfirmed dark-pattern language leave the adtech surface materially weaker than peer states.",
   "claims": [
    {
     "statement": "Recognition of universal opt-out mechanisms is among the most notable items omitted from RIDTPPA compared to other state comprehensive privacy laws.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Confirmed",
     "source_publisher": "International Association of Privacy Professionals",
     "source_url": "https://iapp.org/news/a/omissions-misalignment-raise-questions-with-rhode-island-s-comprehensive-privacy-bill",
     "source_tier": null,
     "observed_at": "2026-08-06"
    }
   ]
  },
  {
   "code": "algorithmic_biometric_and_surveillance_governance",
   "name": "Algorithmic, Biometric & Surveillance Governance",
   "traffic_light": "amber",
   "sub_modules": [
    "ai_risk_assessments",
    "automated_decision_making_transparency",
    "biometric_regime",
    "genetic_data",
    "profiling_restrictions",
    "state_surveillance_carveouts"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-rhode-island/#algorithmic-biometric-and-surveillance-governance-algorithmic-biometric-surveill",
   "traffic_light_rationale": "The AG's DTPA-based AI guidelines are a genuine, currently-active regulatory instrument (green signal), but RIDTPPA's own ADM transparency and biometric/genetic-specific rules remain thin or pending, holding the overall module at amber.",
   "claims": [
    {
     "statement": "The Rhode Island Attorney General has promulgated Guidelines to Prevent Deceptive Trade Practices in the Use of Artificial Intelligence Decision-Making that Impacts Rights, Opportunities, or Access to Resources or Services under R.I. Gen. Laws § 6-13.1 et seq.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "State of Rhode Island",
     "source_url": "https://riag.ri.gov/rules_regulations",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "The Attorney General has and will use existing Deceptive Trade Practices Act authority to enforce against unfair and deceptive practices in the marketing and use of algorithmic and AI-driven software products, while evaluating whether additional AI-specific regulation is necessary.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "State of Rhode Island",
     "source_url": "https://riag.ri.gov/rules_regulations",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "Rhode Island's Senate Bill 767 seeks to safeguard genetic information privacy through strict consumer consent and data disclosure regulations.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Uncertain",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://www.dataguidance.com/jurisdictions/rhode-island",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "RIDTPPA further provides that it does not apply to any state body, authority, board, bureau, or commission, district, or agency of Rhode Island or any political subdivision of Rhode Island.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://legacy.dataguidance.com/notes/rhode-island-data-protection-overview",
     "source_tier": null,
     "observed_at": "2026-08-06"
    }
   ]
  },
  {
   "code": "children_and_vulnerable_groups",
   "name": "Children & Vulnerable Groups",
   "traffic_light": "amber",
   "sub_modules": [
    "age_verification",
    "dependent_adults",
    "education_settings",
    "minor_profiling_bans",
    "parental_consent"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-rhode-island/#children-and-vulnerable-groups-children-vulnerable-groups",
   "traffic_light_rationale": "Baseline COPPA-aligned protection for known children exists and is in force, but the confirmed absence of enhanced/teen-specific protections and the pending (not enacted) status of supplementary bills leave the module materially incomplete.",
   "claims": [
    {
     "statement": "RIDTPPA provides that the term 'child' has the same meaning as in the Children's Online Privacy Protection Act of 1998 (COPPA).",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://legacy.dataguidance.com/notes/rhode-island-data-protection-overview",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "Enhanced children's privacy protections are among the most notable items omitted from RIDTPPA compared to other state comprehensive privacy laws.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Confirmed",
     "source_publisher": "International Association of Privacy Professionals",
     "source_url": "https://iapp.org/news/a/omissions-misalignment-raise-questions-with-rhode-island-s-comprehensive-privacy-bill",
     "source_tier": null,
     "observed_at": "2026-08-06"
    }
   ]
  },
  {
   "code": "enforcement_and_redress",
   "name": "Enforcement & Redress",
   "traffic_light": "amber",
   "sub_modules": [
    "collective_redress_and_class_actions",
    "enforcement_activity_index",
    "private_right_of_action",
    "recent_developments_180d",
    "regulator_funding_and_capacity",
    "regulator_powers_and_penalties"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-rhode-island/#enforcement-and-redress-enforcement-redress",
   "traffic_light_rationale": "Enforcement authority and the no-private-right-of-action position are clearly established (green-level confidence), but the absence of a cure period, lack of confirmed enforcement track record, and unconfirmed regulator funding/capacity data hold the module at amber.",
   "claims": [
    {
     "statement": "A person or entity found in violation of certain RIDTPPA disclosure provisions shall pay a fine of not less than $100 and no more than $500 for each such disclosure.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Probable",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://legacy.dataguidance.com/notes/rhode-island-data-protection-overview",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "Under the RI Deceptive Trade Practices Act, the Attorney General may issue subpoenas, administer oaths or affirmations, conduct hearings in aid of any investigation, and prescribe forms and promulgate rules and regulations that have the force of law.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "State of Rhode Island",
     "source_url": "https://riag.ri.gov/rules_regulations",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "As of the RIDTPPA legal-analysis snapshot reviewed, the Rhode Island Attorney General had not yet issued RIDTPPA-specific compliance guidance.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Uncertain",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://www.dataguidance.com/notes/rhode-island-privacy-overview-0",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "Nothing in RIDTPPA's enforcement section shall be construed to authorize any private right of action to enforce any provision of the chapter, any regulation thereunder, or any other provision of law.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://legacy.dataguidance.com/notes/rhode-island-data-protection-overview",
     "source_tier": null,
     "observed_at": "2026-08-06"
    }
   ]
  }
 ]
}