Rhode Island § 11-49.3-2 § 11-49.3-2. Risk-based information security program.

Rhode Island Statutes

§ 11-49.3-2 — § 11-49.3-2. Risk-based information security program.

Rhode Island § 11-49.3-2

Title 11Criminal Offenses

Ch. 11-49.3Identity Theft Protection Act of 2015

This text of Rhode Island § 11-49.3-2 (§ 11-49.3-2. Risk-based information security program.) is published on Counsel Stack Legal Research, covering Rhode Island primary law. Counsel Stack provides free access to over 12 million legal documents including statutes, case law, regulations, and constitutions.

Bluebook

R.I. Gen. Laws § 11-49.3-2 (2026).

Text

§ 11-49.3-2. Risk-based information security program.
(a) A municipal agency, state agency, or person who or that stores, collects, processes,
            maintains, acquires, uses, owns, or licenses personal information about a Rhode Island
            resident shall implement and maintain a risk-based information security program that
            contains reasonable security procedures and practices appropriate to the size and
            scope of the organization; the nature of the information; and the purpose for which
            the information was collected in order to protect the personal information from unauthorized
            access, use, modification, destruction, or disclosure and to preserve the co

Free access — add to your briefcase to read the full text and ask questions with AI

§ 11-49.3-2. Risk-based information security program.

(a) A municipal agency, state agency, or person who or that stores, collects, processes, maintains, acquires, uses, owns, or licenses personal information about a Rhode Island resident shall implement and maintain a risk-based information security program that contains reasonable security procedures and practices appropriate to the size and scope of the organization; the nature of the information; and the purpose for which the information was collected in order to protect the personal information from unauthorized access, use, modification, destruction, or disclosure and to preserve the confidentiality, integrity, and availability of such information. A municipal agency, state agency, or person shall not retain personal information for a period longer than is reasonably required to provide the services requested; to meet the purpose for which it was collected; or in accordance with a written retention policy or as may be required by law. A municipal agency, state agency, or person shall destroy all personal information, regardless of the medium that such information is in, in a secure manner, including, but not limited to, shredding, pulverization, incineration, or erasure.

(b) A municipal agency, state agency, or person who or that discloses personal information about a Rhode Island resident to a nonaffiliated third party shall require by written contract that the third party implement and maintain reasonable security procedures and practices appropriate to the size and scope of the organization; the nature of the information; and the purpose for which the information was collected in order to protect the personal information from unauthorized access, use, modification, destruction, or disclosure. The provisions of this section shall apply to contracts entered into after the effective date of this act.