The Rhode Island Insurance Division published a bulletin providing an overview of the state’s insurance data security statute to help insurers with compliance. R.I. General Laws § 27-1-46, effective January 1, 2025, sets forth the standards for insurers to have an adequate information security system.

R.I. General Laws § 27-1-46 applies only to domestic insurers; foreign insurers are not required to comply with the statute. The Department clarifies the use of “commensurate with the size and complexity of an insurer” to mean that larger and more complex insurers should have a more robust information security system compared to a small insurer.

Insurers should carefully select third-party service providers and make sure they have implemented measures to protect nonpublic information. Insurers must notify the Department if there has been a cybersecurity event that has a reasonable likelihood of harming insureds in the state. A formal notification is only necessary if over 50 insureds have been harmed.