Tennessee. Comprehensive data protection. Act

TIPATennessee Information Protection Act (Tenn. Code § 47-18-3201 et seq.)

In force

Partly verified

Medium confidence. Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.

§1Summary

Synopsis

Virginia-style rights and duties limited to large businesses, with an affirmative defence for controllers that maintain a privacy programme aligned to the NIST Privacy Framework.

Key themes

consumer rights (access, deletion, correction, portability)
opt-out of sale, targeted advertising and profiling
sensitive data consent
data protection assessments
processor contracts
NIST Privacy Framework affirmative defence

Unique features

Requires $25m revenue plus a volume threshold (175,000 consumers, or 25,000 with 50%+ revenue from sales); NIST-based safe harbour.

SaaS relevance

Only larger SaaS businesses are caught; aligning to NIST PF gives a defence.

§2Obligations

Extraterritorial: Yes
Breach notification: See Tenn. Code § 47-18-2107 (separate statute)
DPO: No
Cross-border transfers: None
Maximum penalty: Up to $7,500 per violation; treble for wilful/knowing

§3Dates

Key dates

Adopted 11 May 2023
In force 1 July 2025

§4Text and authority

Text

Authoritative text wapp.capitol.tn.gov

Authority

Tennessee Attorney General

§5Where it applies

Domestic law of: Tennessee

§6Sources and verification

Sources consulted

wapp.capitol.tn.gov

Verification

Medium confidence.

Partly verified

Medium confidence. Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.