§ 6-48.1-4. Processing of information. [Effective January 1, 2026.]
(a) This section shall apply to for-profit entities that conduct business in the state
or for-profit entities that produce products or services that are targeted to residents
of the state and that during the preceding calendar year did any of the following:
(1) Controlled or processed the personal data of not less than thirty-five thousand (35,000)
customers, excluding personal data controlled or processed solely for the purpose
of completing a payment transaction.
(2) Controlled or processed the perso
Free access — add to your briefcase to read the full text and ask questions with AI
§ 6-48.1-4. Processing of information. [Effective January 1, 2026.]
(a) This section shall apply to for-profit entities that conduct business in the state
or for-profit entities that produce products or services that are targeted to residents
of the state and that during the preceding calendar year did any of the following:
(1) Controlled or processed the personal data of not less than thirty-five thousand (35,000)
customers, excluding personal data controlled or processed solely for the purpose
of completing a payment transaction.
(2) Controlled or processed the personal data of not less than ten thousand (10,000) customers
and derived more than twenty percent (20%) of their gross revenue from the sale of
personal data.
(b) The controller shall establish, implement, and maintain reasonable administrative,
technical, and physical data security practices to protect the confidentiality, integrity,
and accessibility of personal data.
(c) The controller shall not process sensitive data concerning a customer without obtaining
customer consent and shall not process sensitive data of a known child unless consent
is obtained and the information is processed in accordance with COPPA. Controllers
and processors that comply with the verifiable parental consent requirements of the
Children's Online Privacy Protection Act (15 U.S.C. § 6501 et seq.) shall be deemed compliant with any obligation to obtain parental consent
under this chapter.
(d) The controller shall not process personal data in violation of the laws of this state
and federal laws that prohibit unlawful discrimination against customers.
(e) The controller shall provide customers with a mechanism to grant and revoke consent
where consent is required. Upon receipt of revocation, the controller shall suspend
the processing of data as soon as is practicable. The controller shall have no longer
than fifteen (15) days from receipt to effectuate the revocation.