U.S. Tennessee Information Protection Act (TIPA)
- ClassificationCategoryData Protection & PrivacyDomainPrivacyFramework FamilyGlobal Privacy Regulations
- Regulatory ContextTypeRegulationLegal InstrumentActSectorCross-SectorIndustryCross-Industry
- Region / PublisherRegionNorth AmericaRegion DetailTennesseePublisherTennessee General Assembly (Public Chapter 408 of 2023; amended by Public Chapter 201 of 2025); enforced by the Tennessee Attorney General and Reporter
- VersioningVersionPublic Chapter 408 (2023), Tenn. Code Ann. 47-18-3201 to 47-18-3213, as amended by Public Chapter 201 (2025)Effective DateJuly 1, 2025Issue DateMay 11, 2023 (signed by the Governor); Public Chapter 408 filed May 24, 2023
- AdoptionAdoption ModelRegulatory ComplianceImplementation ComplexityMedium
- Official ReferenceOpen Link in New TabSource
License included / downloadable: Yes
The Tennessee Information Protection Act is state law, published free as Public Chapter 408 of 2023 by the Tennessee Secretary of State and on the General Assembly's website. The platform links to the official text.
Framework text is licensed by its publisher and is included only where stated above.
- The Tennessee Information Protection Act gives residents privacy rights and binds businesses exceeding $25 million in revenue that meet a data-volume test.
- It took effect July 1, 2025 and is enforced only by the Tennessee Attorney General, after a 60-day notice and cure window.
- Controllers honor access, correction, deletion, portability, and opt-out requests within 45 days and obtain consent before processing sensitive data.
- Section 47-18-3213 gives an affirmative defense to a controller with a written privacy program that reasonably conforms to the NIST Privacy Framework.
- Civil penalties reach $7,500 per violation, trebled for willful or knowing violations; there is no private right of action.
Overview
The Tennessee Information Protection Act (TIPA) is a state consumer privacy law that gives Tennessee residents rights over their personal information and sets duties for businesses that exceed $25 million in revenue and meet a data-volume test; it took effect on July 1, 2025 and is enforced only by the Tennessee Attorney General and Reporter. It is codified at Tennessee Code Annotated sections 47-18-3201 to 47-18-3213.
The General Assembly passed House Bill 1181 (Senate Bill 73) in April 2023, Governor Bill Lee signed it on May 11, 2023, and it became Public Chapter 408 of 2023. Public Chapter 201 of 2025 later revised the definition of a nonprofit organization so that a public utility organized or regulated, not only organized, under Tennessee law qualifies for the exemption. Section 47-18-3213 gives a controller or processor an affirmative defense if it keeps a written privacy program that reasonably conforms to the NIST Privacy Framework, so documented program evidence matters.
A covered controller honors access, correction, deletion, portability and opt-out requests within 45 days, publishes a privacy notice, obtains consent before processing sensitive data, documents data protection assessments for high-risk processing, and binds processors by contract.
Why does it matter?
TIPA matters because its exposure is specific and its defense is written into the statute. Only the Attorney General can enforce it, after a 60-day written notice and cure window, and a court may impose a civil penalty of up to $7,500 per violation, trebled for willful or knowing violations. There is no private right of action. A company that creates, maintains and follows a written privacy program that reasonably conforms to the NIST Privacy Framework, as section 47-18-3213 describes, may assert an affirmative defense, so program evidence is the central compliance artifact rather than a policy binder.
Key benefits include:
- A two-part threshold
Section 47-18-3202 reaches businesses targeting Tennessee residents that exceed $25 million in revenue and either process 175,000 consumers' data in a calendar year or 25,000 consumers' data with over half of revenue from selling it.
- A 45-day request clock
Under section 47-18-3203 a controller responds within 45 days, extendable once by 45 more, and must offer a free appeal decided within 60 days.
- Consent for sensitive data
Section 47-18-3204(a)(6) bars processing sensitive data without consent, and for a known child it requires processing under COPPA.
- Documented assessments
Section 47-18-3206 requires a data protection assessment for targeted advertising, sales, risky profiling and sensitive data.
- A cure period before suit
Section 47-18-3212 requires 60 days' written notice, and a written cure statement stops the action.
How does it work?
Section 47-18-3203 gives a consumer five rights: to confirm and access personal information, to correct, to delete, to obtain a portable copy and to opt out of sale, targeted advertising and profiling that produces legal or similarly significant effects. A controller authenticates the request, answers within 45 days, explains any refusal and the appeal path, and may charge a reasonable fee only for manifestly unfounded, excessive or repetitive requests; two free responses a year are required. If an appeal is denied, the controller must tell the consumer how to contact the Attorney General.
Section 47-18-3204 sets the controller's duties: limit collection to what is adequate, relevant and reasonably necessary; process only for disclosed purposes unless the consumer consents; maintain reasonable administrative, technical and physical security practices; avoid discrimination for exercising rights; and publish a privacy notice listing categories processed, purposes, how to exercise rights and appeal, and any categories sold and recipients. Section 47-18-3205 requires a binding contract with each processor covering instructions, confidentiality, deletion or return, assessments and subcontractors.
Enforcement runs through section 47-18-3209, which lets the Attorney General issue a civil investigative demand on reasonable cause, and section 47-18-3206(c), which lets the Attorney General require a controller to produce a data protection assessment, kept confidential and without waiver of privilege. Section 47-18-3211 voids any contract term that waives consumer rights. Section 4 of the Act preempts conflicting home rule municipal and county rules on the processing of personal data, and section 6 sets the July 1, 2025 effective date.
Key Elements
- Consumer (47-18-3201)
A Tennessee resident acting in a personal context; a person acting in a commercial or employment context is excluded.
- Sensitive data (47-18-3201)
Racial or ethnic origin, religious beliefs, health diagnosis, sexual orientation, citizenship or immigration status, genetic or biometric data used to identify a person, a known child's data and precise geolocation within 1,750 feet.
- Consumer rights (47-18-3203)
Confirm and access, correct, delete, portable copy, and opt out of sale, targeted advertising and significant-effect profiling.
- Privacy notice (47-18-3204)
Categories processed, purposes, how to exercise and appeal rights, categories sold and to whom, with clear disclosure of sale or targeted advertising.
- Data protection assessment (47-18-3206)
Weighs benefits against risks and safeguards; applies to processing created or generated on or after July 1, 2024; confidential when given to the Attorney General.
- Affirmative defense (47-18-3213)
A written privacy program that reasonably conforms to NIST Privacy Framework Version 1.0 or comparable documented standards, updated within two years of a revision, scaled to the business.
What does it cover?
TIPA applies to persons that conduct business in Tennessee producing products or services that target residents and that exceed $25 million in revenue and also meet one of two tests: controlling or processing personal information of at least 25,000 consumers while deriving more than half of gross revenue from its sale, or controlling or processing the personal information of at least 175,000 consumers in a calendar year (section 47-18-3202). Section 47-18-3210 exempts state and local government, financial institutions and Gramm-Leach-Bliley data, insurers and licensed producers, HIPAA covered entities and business associates and protected health information, nonprofit organizations, institutions of higher education, and employment and applicant data.
What are its objectives?
The Act has no statement of purpose; its objectives follow from sections 47-18-3203 to 47-18-3213, which give residents defined rights and hold larger businesses to defined handling standards.
Give Tennessee consumers enforceable rights to access, correct, delete, port and opt out.
Require disclosed, limited and consented processing, with consent for sensitive data.
Require documented assessments for sales, targeted advertising, risky profiling and sensitive data.
Reserve enforcement to the Attorney General with a 60-day cure opportunity and a civil penalty cap per violation.
Reward a documented privacy program through the NIST Privacy Framework affirmative defense.
Framework in Context
TIPA uses the controller and processor roles and defers to the federal sector laws it names in section 47-18-3210: the Gramm-Leach-Bliley Act, HIPAA and the HITECH Act, the Fair Credit Reporting Act, FERPA, the Driver's Privacy Protection Act and the Farm Credit Act. It treats compliance with the federal Children's Online Privacy Protection Act as compliance with its parental consent duty (section 47-18-3210(b)). Section 47-18-3213(c) lets APEC Cross Border Privacy Rules certification for a controller, and Privacy Recognition for Processors certification for a processor, count when a program's scale is judged. Organizations that hold exempt regulated data therefore apply TIPA only to the remaining consumer data.
Common Framework Mappings
Organizations map TIPA to privacy and security frameworks so that one set of data inventories, request procedures and assessments serves Tennessee and the other state laws they face.
Mapped frameworks include:
CIS Controls v8.1
GDPR
HIPAA
ISO 27001:2022
NIST CSF 2.0
NIST 800-53 Rev.5
PCI DSS 4.0.1
SOC 2
CCPA/CPRA
How SmartSuite Supports TIPA
SmartSuite provides the system for managing controls, evidence, mappings, assessments, and reporting.
Use Privacy Management to keep the data inventory, the section 47-18-3203 request queue with the 45-day clock and appeal, and the section 47-18-3206 assessments, and Compliance Management to hold the NIST Privacy Framework evidence behind the section 47-18-3213 affirmative defense.
Applicability Test
Record revenue and consumer counts against the section 47-18-3202 thresholds, the exemptions that apply in section 47-18-3210 and the data in scope.
Request and Appeal Queue
Track access, correction, deletion, portability and opt-out requests against the 45-day deadline, the one 45-day extension and the 60-day appeal response.
Sensitive Data and Consent Register
Link each sensitive-data use to the consumer's consent or the COPPA process for a known child under section 47-18-3204(a)(6).
Data Protection Assessments
Hold the section 47-18-3206 assessments for sales, targeted advertising, profiling and sensitive data, with benefits, risks and safeguards.
Processor Contracts
Track each section 47-18-3205 processor contract for instructions, confidentiality, deletion or return, assessments and subcontractors.
Affirmative Defense Evidence
Map the written privacy program to the NIST Privacy Framework and keep the update history that section 47-18-3213 asks for.
Related frameworks
The CCPA, as amended by the CPRA, gives California residents rights to know, delete, correct and opt out, and is enforced by the California Privacy Protection Agency.
The Colorado Privacy Act (C.R.S. 6-1-1301 et seq.) gives Colorado consumers opt-out, access, correction, deletion and portability rights and sets controller duties.
The GDPR (Regulation (EU) 2016/679) sets principles, lawful bases, individual rights and accountability duties for personal data, with fines up to EUR 20 million or 4 percent of turnover.
ISO/IEC 27001:2022 specifies requirements for an information security management system: Clauses 4 to 10, risk treatment, the Statement of Applicability and 93 Annex A controls.
Frequently Asked Questions For U.S. Tennessee Information Protection Act (TIPA)
Section 47-18-3202 covers persons that conduct business in Tennessee producing products or services that target residents, that exceed $25 million in revenue, and that either control or process the personal information of at least 25,000 consumers while deriving more than half of gross revenue from its sale, or process the data of at least 175,000 consumers in a calendar year. Section 47-18-3210 exempts government bodies, financial institutions, insurers, HIPAA entities, nonprofits, higher education institutions and employment data.
Section 47-18-3203 requires a response without undue delay and within 45 days of receipt, extendable once by 45 days if the controller tells the consumer why within the first 45 days. A refusal must state the reason and explain how to appeal, and the controller must decide an appeal within 60 days. Responses are free up to twice a year per consumer.
Section 47-18-3213 gives a controller or processor an affirmative defense if it creates, maintains and complies with a written privacy policy that reasonably conforms to the NIST Privacy Framework, Version 1.0, or comparable documented standards, is updated within two years of a revised framework, and provides the rights the Act requires. Scale and scope depend on business size, the sensitivity of data and the cost of tools. APEC CBPR or PRP certification may also be considered.
Only the Attorney General and Reporter enforces it (section 47-18-3212). The Attorney General must give 60 days' written notice naming the provisions violated, and no action follows if the company cures and gives a written statement that no further violations will occur. A court may then award injunctive relief, a civil penalty of up to $7,500 per violation, treble damages for willful or knowing violations and investigative costs. Violations give no private right of action.
Yes. Section 47-18-3206 requires a controller to conduct and document an assessment for targeted advertising, the sale of personal information, profiling that creates a reasonably foreseeable risk of harm, processing of sensitive data and other heightened-risk processing. The assessment weighs benefits against risks and safeguards, applies to processing created or generated on or after July 1, 2024, and must be produced to the Attorney General on a civil investigative demand.
Put this framework to work in SmartSuite
Manage controls, risks, evidence, and audits in one platform designed for modern governance, risk, and compliance.