Rhode Island SaaS Agreement Review
Rhode Island's privacy law is new as of 2026 and reaches further down the market than most. The Data Transparency and Privacy Protection Act applies from January 1, 2026, at 35,000 Rhode Island consumers, a real number for a Providence retailer or a Warwick healthcare group. Rhode Island also taxes vendor-hosted software, so both the processor terms and the invoice deserve a close look.
Consumer privacy law in Rhode Island
Rhode Island Data Transparency and Privacy Protection Act
In force since January 1, 2026. Applies at 35,000 consumers, or 10,000 where more than 20% of revenue comes from selling personal data, a materially lower bar than most states.
Data rights in Rhode Island
Rhode Island has enacted the Rhode Island Data Transparency and Privacy Protection Act, a comprehensive consumer privacy law. It gives residents rights over their personal data, typically access, correction, deletion, and the ability to opt out of the sale of data and targeted advertising, and generally requires vendors to sign a data-processing agreement. When you buy SaaS that will hold data about Rhode Island residents, the vendor's terms should line up with those obligations.
The clauses that decide your risk
- Data use & AI training, is your data used only to provide the service, or to "improve" (train) the vendor’s models?
- Liability cap, often just one month of fees, against real data-loss exposure
- Auto-renewal, the cancellation-notice window (miss it and you renew for a year)
- Price increases, capped, or unilateral at renewal?
- Data export & deletion on termination, can you get your data out, and is it deleted?
- Uptime SLA and service credits
What does the new Rhode Island privacy act require?
The act, at R.I. Gen. Laws 6-48.1, covers businesses that control or process personal data of at least 35,000 Rhode Island customers, or 10,000 where more than 20% of gross revenue comes from selling personal data. It follows the Connecticut-style template: consumer rights to access, correct, delete and opt out of sale and targeted advertising, data protection assessments, and a binding controller-processor contract. The attorney general enforces it, and the act does not provide a cure period.
The law also requires commercial websites and online services that collect Rhode Islanders' data to identify the third parties to whom personal data has been or may be sold. Check whether your SaaS vendor's subprocessor list is detailed enough to support that disclosure. Because the act has no revenue test, a regional retailer or clinic can be covered even with modest sales.
Breach notice and tax
Rhode Island's Identity Theft Protection Act, R.I. Gen. Laws 11-49.3, requires notice to affected residents within 45 calendar days of confirming a breach, and notice to the attorney general and consumer reporting agencies when more than 500 residents are affected. Since October 2018, vendor-hosted prewritten software has been subject to the 7% sales tax, so SaaS invoices to Rhode Island addresses usually include it at that rate.
Rhode Island sources checked 2026-10-09: Hunton, Rhode Island privacy act overview · Davis Wright Tremaine, Rhode Island breach summary · Avalara, SaaS taxable in Rhode Island from October 2018. Laws change; confirm the current rule before relying on it.
Rhode Island SaaS agreement FAQ
Does Rhode Island have a data privacy law that affects SaaS contracts?
Yes. Rhode Island has enacted a comprehensive consumer privacy law, the Rhode Island Data Transparency and Privacy Protection Act. It gives residents rights over their personal data (such as access, deletion, and opting out of sale or targeted advertising) and generally requires a data-processing agreement, which shapes what a SaaS vendor can do with data about Rhode Island residents. Note the scope: In force since January 1, 2026. Applies at 35,000 consumers, or 10,000 where more than 20% of revenue comes from selling personal data, a materially lower bar than most states.
Can a SaaS vendor use my Rhode Island business's data to train AI?
Only if the contract lets them. Many SaaS agreements grant the vendor a right to use "customer data" to "improve the services," which can extend to training models. Regardless of Rhode Island law, insist the contract says your data is never used to train shared or general-purpose models and is processed only to provide the service to you.
What should I check before signing a SaaS agreement in Rhode Island?
The clauses that decide your risk: how your data can be used (and whether it trains AI), the liability cap versus your data-loss exposure, auto-renewal and the cancellation-notice window, unilateral price increases, and whether you can export and require deletion of your data on termination. ClauseAudit flags each against Rhode Island law in about a minute.
Is there a grace period to fix Rhode Island privacy violations?
No. Unlike many states, Rhode Island's privacy act does not include a notice-and-cure period, so the attorney general can act on a violation from the January 1, 2026 start date. Make sure the processor terms with your SaaS vendors are in place now rather than waiting for a complaint.
Do Rhode Island businesses pay sales tax on SaaS?
Generally yes. Rhode Island taxes vendor-hosted prewritten software at the 7% sales tax rate, a change that took effect in October 2018. Check that the vendor collects the tax correctly; if it does not, a Rhode Island business may owe use tax directly.
Reviewing a SaaS contract in Rhode Island?
Upload it and get the data, liability, and renewal terms checked against Rhode Island law in about a minute.
State privacy-law status summarized as of October 2026; this area changes quickly and thresholds and effective dates vary. This is automated educational information, not legal advice, ClauseAudit verifies current Rhode Island law when you run your agreement, and you should confirm anything critical with a qualified attorney.