Obligations United States Rhode Island
What a Rhode Island business has to have in writing
Rhode Island bundles data security into its breach statute: the Identity Theft Protection Act makes any business holding personal information keep reasonable safeguards and a written retention and destruction practice, then notify residents within 45 days and the Attorney General once more than 500 Rhode Islanders are involved.
From January 2026 the Data Transparency and Privacy Protection Act adds a privacy notice that names the third parties a controller sells data to.
Employers with 50 or more staff must hand out a written sexual harassment policy, every employer with hazardous chemicals registers annually under the Right-to-Know law, and wage ranges must be given to applicants before pay is discussed.
Headcount
Industry General is always on
Sponsored
Policy Acknowledgment Proof
Rhode IslandHandbook 2026acknowledged by name
Rhode Island on Recordwith AllyMatter
Cover Rhode Island the Modern WayEvery policy Rhode Island makes you write, acknowledged by name
01
Approve it, lock the version
Non-author approval, obsolete copies blocked
02
Every employee in Rhode Island on record
Who read which version, and when
03
Walk into any state inspection with the trail
From $29/mo, 20 editors, unlimited staff (published)
What applies
Rhode Island rules for a 15–19 person general business
State law only. The federal layer every employer carries sits on the business-type pages below. Each row names what you must write, post, file or certify, who enforces it, and links to the state authority.
Breach Notification 1Who you must tell after a data breach, and how fast
LawProduceWhat it requiresTriggerEnforced by
Rhode Island Identity Theft Protection Act of 2015AI-compiledR.I. Gen. Laws chapter 11-49.3Any municipal agency, state agency or person that stores, collects, processes, maintains, acquires, uses, owns or licenses personal information about a Rhode Island residentDistribute + ack
Notice
Notify affected Rhode Island residents in writing within 45 days of confirming a breach, describing what happened, what data was involved and what the business is doing about it. When more than 500 residents must be notified, tell the Attorney General and the major credit reporting agencies the timing, content, distribution and approximate number affected, without holding up the consumer notices.
From the first employee
Rhode Island Attorney General (exclusive enforcement)
Data Security Program 1A written safeguards program the state requires before anything goes wrong
LawProduceWhat it requiresTriggerEnforced by
Duty to protect personal information (Identity Theft Protection Act)AI-compiledR.I. Gen. Laws § 11-49.3-2Any business or agency that holds personal information about a Rhode Island resident, whether or not it does business in the stateWrite
Written program
Maintain a risk-based information security program with reasonable administrative, technical and physical safeguards for the personal information held, keep that data only as long as there is a business or legal reason for it, destroy it securely afterwards, and put the same duties on service providers by contract.
From the first employee
Rhode Island Attorney General
Consumer Privacy Law 1Rights, notices and assessments for consumer data
LawProduceWhat it requiresTriggerEnforced by
Rhode Island Data Transparency and Privacy Protection ActAI-compiledR.I. Gen. Laws chapter 6-48.1 (2024-H 7787 / S 2500), effective January 1, 2026For-profit entities doing business in Rhode Island or targeting Rhode Islanders that in a year control or process personal data of 35,000+ customers, or 10,000+ customers while earning more than 20% of gross revenue from selling personal data; the website disclosure duty reaches commercial websites and internet service providers more broadlyWrite
Written policy
Publish a privacy notice that lists the categories of personal data collected and disclosed, the purposes, and - unusually for a state privacy law - names all third parties to whom the data has been or may be sold. Get opt-in consent before processing sensitive data, offer a way to give and withdraw consent, document data protection assessments for higher-risk processing, and honor access, correction, deletion, portability and opt-out requests.
From the first employee
Rhode Island Attorney General
Harassment Prevention 1A written policy, and in some states annual training, on harassment
LawProduceWhat it requiresTriggerEnforced by
Sexual Harassment, Education and Training in the Workplace ActAI-compiledR.I. Gen. Laws § 28-51-2Employers with 50 or more employeesWrite
Written policy
Adopt a written policy against sexual harassment that defines it with examples, states that retaliation for complaining or cooperating is unlawful, sets out the range of consequences, explains the internal complaint route with the names, work addresses and phone numbers of the people who take complaints, and identifies the state and federal enforcement agencies. Give a copy to every employee, including each new hire on day one, keep copies on the premises and hand them to an enforcement agency on request.
50+ employees
Rhode Island Commission for Human Rights; Rhode Island Department of Labor and Training (posting)
Workplace Safety Programs 1Written programs the state safety agency requires beyond federal OSHA
LawProduceWhat it requiresTriggerEnforced by
Hazardous Substances Right-to-Know ActAI-compiledR.I. Gen. Laws chapter 28-21Any employer with at least one full- or part-time employee that keeps more than 2 gallons or 10 pounds of a designated hazardous substance, or a product containing 1% or more of a carcinogenWrite
Written program
File the annual Right-to-Know registration with the Department of Labor and Training, obtain safety data sheets from suppliers, keep an alphabetical chemical identification list cross-referenced to chemical names and available to employees during all operating hours, label containers, train employees each year, and submit documentation of that training. Rhode Island has no OSHA-approved state plan, so federal OSHA covers general workplace safety.
From the first employee
Rhode Island Department of Labor and Training, Occupational Safety Unit
Insurance Data Security 1The written security program insurance licensees must certify
LawProduceWhat it requiresTriggerEnforced by
Rhode Island Insurance Data Security ActAI-compiledP.L. 2022 (2022-H 7281 / S 2744), effective January 1, 2025; 230-RICR-20-60-8 (safeguarding customer information)Insurance licensees of the Department of Business Regulation, domestic and foreign, that hold nonpublic informationCertify
Certification
Build a written information security program on a documented risk assessment, oversee third-party service providers, investigate cybersecurity events and notify the Insurance Commissioner, and - for Rhode Island-domiciled licensees - file an annual certification of compliance by April 15 and keep the supporting records for five years. A domestic licensee already meeting HIPAA and HITECH may certify on the strength of that program.
From the first employee
Rhode Island Department of Business Regulation, Insurance Division
Paid Leave Policies 1Sick and family leave laws that come with a written policy or notice
LawProduceWhat it requiresTriggerEnforced by
Healthy and Safe Families and Workplaces ActAI-compiledR.I. Gen. Laws chapter 28-57Every Rhode Island employer; leave is paid at 18 or more employees and unpaid below thatWrite
Written policy
Let employees accrue at least one hour of sick and safe leave for every 35 hours worked, up to 40 hours a year, or front-load the 40 hours. Put the accrual, carryover and notice rules in a written policy, tell employees what they have accrued, and display the DLT notice covering the law.
From the first employee
Rhode Island Department of Labor and Training, Labor Standards Unit
Required Postings 1The notices every workplace in the state must display
LawProduceWhat it requiresTriggerEnforced by
Required workplace postersAI-compiledVarious (R.I. Gen. Laws chapters 28-5, 28-12, 28-14, 28-21, 28-33, 28-41, 28-48, 28-51, 28-57)Every Rhode Island employer, at each worksitePost
Posting
Display the DLT combination poster and the separate state notices where employees can read them: minimum wage and wage payment, sick and safe leave, parental and family medical leave, temporary disability and caregiver insurance, unemployment, workers' compensation, child labor, Right-to-Know, pregnancy accommodation, no-smoking and sexual harassment. Remote workers may be sent the DLT poster page instead.
From the first employee
Rhode Island Department of Labor and Training
Pay Transparency 1Salary ranges in job posts and pay disclosure on request
LawProduceWhat it requiresTriggerEnforced by
Rhode Island Pay Equity Act wage range disclosureAI-compiledR.I. Gen. Laws § 28-6-22 (2021-H 5261A), effective January 1, 2023Every Rhode Island employer, with no employee-count thresholdDistribute
Notice
Give an applicant the wage range for the job before any discussion of compensation, give an employee the range at hire and again when they move into a new position, and provide it whenever an employee asks. The range is what the employer expects to rely on when setting pay, or what people already in equivalent jobs are paid. Asking about salary history before an offer is off limits.
From the first employee
Rhode Island Department of Labor and Training; private civil action
Licensing and Certifications 3Registrations, licences and certifications a business or its staff must hold
LawProduceWhat it requiresTriggerEnforced by
Business registration (Secretary of State Business Services Division)AI-compiledR.I. Gen. Laws title 7 (business corporations, LLCs, partnerships); R.I. Gen. Laws § 6-1-1 (fictitious names)Corporations, LLCs, limited partnerships, nonprofits and out-of-state entities transacting business in Rhode IslandFile
Filing / record
File formation or foreign qualification documents with the Business Services Division, name a resident agent with a Rhode Island address, and file the annual report in the window the statute sets for the entity type. Rhode Island has no single statewide general business licence, so trade-specific licences and local permits are separate.
From the first employee
Rhode Island Department of State, Business Services Division
Contractor registration and licensingAI-compiledR.I. Gen. Laws chapter 5-65; 440-RICR-10-00-2Contractors, remodelers and most subcontractors building or repairing residential or commercial structures in Rhode IslandFile
Filing / record
Register with the Contractors' Registration and Licensing Board before bidding or working, showing a state-approved five-hour pre-registration course (waived for purely commercial work), at least $500,000 general liability coverage and workers' compensation coverage if you have employees, both naming the Board as certificate holder. Keep the registration number on contracts and advertising and renew it on the Board's cycle.
From the first employee
Rhode Island Contractors' Registration and Licensing Board
Food service licensing and certified manager in food safetyAI-compiledR.I. Gen. Laws chapter 21-27; 216-RICR-50-10-2Food establishments licensed by the Department of Health that prepare time and temperature control for safety foodsCertify
Certification
Hold and renew the Department of Health food service licence, and keep at least one certified manager in food safety on site during all hours of operation - two when more than ten employees prepare food. Certificates hang next to the licence in public view, and certification rests on an approved course and proctored exam taken within three years of applying.
From the first employee
Rhode Island Department of Health, Center for Food Protection
Other Written Policies 1Any other document the state makes an employer write or hand out
LawProduceWhat it requiresTriggerEnforced by
Rhode Island Noncompetition Agreement ActAI-compiledR.I. Gen. Laws chapter 28-59Employers using noncompetition agreements with Rhode Island workersWrite
Written policy
Keep noncompetition terms out of agreements with employees who are non-exempt under the Fair Labor Standards Act, undergraduate or graduate student interns, workers aged 18 or under, and low-wage earners as the statute defines them. Any noncompete used with other staff has to be a separate, identifiable written term.
From the first employee
Rhode Island courts; Rhode Island Department of Labor and Training
From the publisher
Keep Your Written Policies in One Place
Whatever you are working toward, AllyMatter gets your policies approved, keeps every version and records who has read each one.
See how AllyMatter works ↗From $29/mo, 20 editors, unlimited staff
Add the federal layer
Your business type, with Rhode Island on top
Small businessFederal + industry, with Rhode Island on topConstruction contractorsFederal + industry, with Rhode Island on topHealthcare practicesFederal + industry, with Rhode Island on topFood and beverage businessesFederal + industry, with Rhode Island on topTax and accounting firmsFederal + industry, with Rhode Island on topRegistered investment advisersFederal + industry, with Rhode Island on topInsurance agenciesFederal + industry, with Rhode Island on topRetail and e-commerceFederal + industry, with Rhode Island on topTrucking and logistics carriersFederal + industry, with Rhode Island on topNonprofitsFederal + industry, with Rhode Island on topFederal contractorsFederal + industry, with Rhode Island on top
Other states
The same index for another state
Alabama12Alaska12Arizona11Arkansas14California20Colorado18Connecticut17Delaware17District of Columbia12Florida15Georgia13Hawaii16Idaho13Illinois19Indiana16Iowa13Kansas11Kentucky14Louisiana13Maine14Maryland19Massachusetts16Michigan15Minnesota19Mississippi11Missouri12Montana15Nebraska13Nevada18New Hampshire13New Jersey19New Mexico13New York17North Carolina12North Dakota13Ohio13Oklahoma11Oregon19Pennsylvania12South Carolina12South Dakota11Tennessee14Texas15Utah13Vermont17Virginia17Washington21West Virginia14Wisconsin15Wyoming13
Need a hand implementing it?
Find a Consultant Who Does This Work
Tell us what you need done and we will point you to firms that do this work. Your details go to a firm only when you choose it.
Sources
Rhode Island Attorney General - Data Breach NotificationsRhode Island General Assembly - Chapter 11-49.3Rhode Island Attorney General - Consumer Protection UnitRhode Island General Assembly - Chapter 6-48.1Rhode Island General Assembly - Chapter 28-51Rhode Island DLT - Required Posters for the WorkplaceRhode Island DLT - Right to Know Guidelines for EmployersRhode Island DLT - Right-to-Know Law brochureRhode Island General Assembly - Chapter 28-21Rhode Island DBR - Insurance Bulletin 2025-1 Insurance Data SecurityRhode Island Department of State - Standards for Safeguarding Customer Information (230-RICR-20-60-8)Rhode Island General Assembly - 2022 S 2744Rhode Island DLT - Paid Sick and Safe LeaveRhode Island DLT - Labor StandardsRhode Island DLT - Pay Equity ActRhode Island General Assembly - R.I. Gen. Laws § 28-6-22Rhode Island DLT - Pay Equity Act guidanceRhode Island Department of State - Business ServicesRhode Island Department of State - Rules and RegulationsRhode Island Contractors' Registration and Licensing Board - Contractor FAQsRhode Island CRLB - Apply for general contractor registrationRhode Island Department of State - Registration of Contractors (440-RICR-10-00-2)Rhode Island Department of Health - Food ServiceRhode Island Department of Health - Food Safety ManagersRhode Island Department of State - Certification of Managers in Food Safety (216-RICR-50-10-2)Rhode Island General Assembly - Chapter 28-59