Tennessee Information Protection Act (TIPA)
The Tennessee Information Protection Act (Tenn. Code Ann. 47-18-3301 et seq., effective 1 July 2025) applies to businesses with over $25 million revenue that process personal information of 175,000 Tennessee consumers, or 25,000 while earning over half their revenue from data sales. It gives consumers rights to access, correct, delete and port data and to opt out of sale, targeted advertising and significant profiling, requires privacy notices, data minimisation, reasonable security, consent for sensitive data, processor contracts and data protection assessments, and is enforced only by the Attorney General after a 60-day cure period with penalties up to $7,500 per violation. A written privacy programme conforming to the NIST Privacy Framework is an affirmative defense.
Tennessee Information Protection Act (TIPA) is a compliance framework from United States (Tennessee) with 6 domains and 17 controls. The largest domains are Controller duties (s 47-18-3305, 3312) – Tennessee Information Protection Act (TIPA) (7 controls), Consumer rights and request handling (s 47-18-3304) – Tennessee Information Protection Act (TIPA) (3 controls), De-identified and pseudonymous data, exemption use (ss 47-18-3308, 3309) – Tennessee Information Protection Act (TIPA) (2 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (6)
Consumer rights and request handling (s 47-18-3304) – Tennessee Information Protection Act (TIPA)
| Code | Title |
|---|---|
| tennessee-information-protection-act-tipa::S3304-1 | Honour authenticated requests to access, correct, delete, port and opt out |
| tennessee-information-protection-act-tipa::S3304-2 | Respond within 45 days, free twice a year, with authentication and reasons for refusal |
| tennessee-information-protection-act-tipa::S3304-3 | Run a free, conspicuous appeal process with a 60-day written answer |
Controller duties (s 47-18-3305, 3312) – Tennessee Information Protection Act (TIPA)
| Code | Title |
|---|---|
| tennessee-information-protection-act-tipa::S3305-1 | Limit collection to what is necessary and processing to disclosed, compatible purposes |
| tennessee-information-protection-act-tipa::S3305-2 | Maintain reasonable administrative, technical and physical data security |
| tennessee-information-protection-act-tipa::S3305-3 | Do not discriminate unlawfully or penalise consumers for exercising rights |
| tennessee-information-protection-act-tipa::S3305-4 | Obtain consent before processing sensitive data; follow COPPA for known children |
| tennessee-information-protection-act-tipa::S3305-5 | Publish a clear privacy notice and disclose sale and targeted advertising with the opt-out route |
| tennessee-information-protection-act-tipa::S3305-6 | Offer secure request channels and never require a new account |
| tennessee-information-protection-act-tipa::S3312 | Keep contracts and terms free of waivers of consumer rights |
Data protection assessments (s 47-18-3307) – Tennessee Information Protection Act (TIPA)
| Code | Title |
|---|---|
| tennessee-information-protection-act-tipa::S3307 | Conduct and document data protection assessments for high-risk processing and give them to the AG on demand |
De-identified and pseudonymous data, exemption use (ss 47-18-3308, 3309) – Tennessee Information Protection Act (TIPA)
| Code | Title |
|---|---|
| tennessee-information-protection-act-tipa::S3308 | Keep de-identified data de-identified and oversee recipients of de-identified or pseudonymous data |
| tennessee-information-protection-act-tipa::S3309 | Keep processing under an exemption necessary, proportionate and secured, and be able to prove it |
Enforcement cooperation and the affirmative defense (ss 47-18-3310, 3313, 3314) – Tennessee Information Protection Act (TIPA)
| Code | Title |
|---|---|
| tennessee-information-protection-act-tipa::S3313 | Answer AG civil investigative demands and cure noticed violations within 60 days with a written statement |
| tennessee-information-protection-act-tipa::S3314 | Maintain a written privacy programme that conforms to the NIST Privacy Framework (affirmative defense) |
Processors and contracts (s 47-18-3306) – Tennessee Information Protection Act (TIPA)
| Code | Title |
|---|---|
| tennessee-information-protection-act-tipa::S3306-1 | Processor: follow the controller's instructions and help it meet rights requests and assessments |
| tennessee-information-protection-act-tipa::S3306-2 | Put a binding controller-processor contract in place with the required terms |
What is Tennessee Information Protection Act (TIPA) and who does it apply to?
Tennessee Information Protection Act (TIPA) is a compliance framework from United States (Tennessee) with 6 domains and 17 controls. The Tennessee Information Protection Act (Tenn. Code Ann. 47-18-3301 et seq., effective 1 July 2025) applies to businesses with over $25 million revenue that process personal information of 175,000 Tennessee consumers, or 25,000 while earning over half their revenue from data sales. It gives consumers rights to access, correct, delete and port data and to opt out of sale, targeted advertising and significant profiling, requires privacy notices, data minimisation, reasonable security, consent for sensitive data, processor contracts and data protection assessments, and is enforced only by the Attorney General after a 60-day cure period with penalties up to $7,500 per violation. A written privacy programme conforming to the NIST Privacy Framework is an affirmative defense. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does Tennessee Information Protection Act (TIPA) actually require?
Tennessee Information Protection Act (TIPA) has 17 controls organised across 6 domains. The largest domains are Controller duties (s 47-18-3305, 3312) – Tennessee Information Protection Act (TIPA) (7 controls), Consumer rights and request handling (s 47-18-3304) – Tennessee Information Protection Act (TIPA) (3 controls), De-identified and pseudonymous data, exemption use (ss 47-18-3308, 3309) – Tennessee Information Protection Act (TIPA) (2 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of Tennessee Information Protection Act (TIPA) do I already cover?
Tennessee Information Protection Act (TIPA) does not currently have cross-framework mappings in our system. Check back as we continuously expand our mapping database.
How do I implement Tennessee Information Protection Act (TIPA)?
Start your Tennessee Information Protection Act (TIPA) compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about Tennessee Information Protection Act (TIPA) requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 17 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,120 frameworks.
Get Started Free →Free forever, no credit card required