Tennessee Information Protection Act (TIPA)

United States — Tennessee

v2023 (effective 2025)

10 domains

18 controls

The Tennessee Information Protection Act (HB 1181, effective July 1, 2025) provides comprehensive consumer privacy rights. Applies to entities conducting business in Tennessee that control or process personal data of 175,000+ consumers, or 25,000+ consumers while deriving over 50% of gross revenue from data sales. Notable for affirmative defence for controllers maintaining privacy programs conforming to NIST Privacy Framework.

Verified

Tennessee Information Protection Act (TIPA) is a compliance framework from United States — Tennessee with 10 domains and 18 controls. The largest domains are Consumer Rights (3 controls), Governance, Training and Records (3 controls), Assessments and Profiling (2 controls). Every control below carries what it requires and what an assessor expects to see.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (10)

Assessments and Profiling

2 controls

Assessments and Profiling

Controls in the Assessments and Profiling domain of Tennessee Information Protection Act (TIPA) — 2 controls
Code	Title	Description
TIPA-07	Data Protection Assessments	Controllers must conduct assessments for processing that presents heightened risk, including targeted advertising, sale,...
TIPA-12	Profiling with Significant Effects	Profiling that produces legal or similarly significant effects must be assessed, monitored, and accompanied by safeguard...

Consumer Rights

3 controls

Consumer Rights

Controls in the Consumer Rights domain of Tennessee Information Protection Act (TIPA) — 3 controls
Code	Title	Description
TIPA-03	Consumer Rights Operations	Controllers must operate processes for access, correction, deletion, portability, and opt out of targeted advertising, s...
TIPA-04	Opt Out of Targeted Advertising, Sale, and Profiling	Controllers must offer accessible opt outs for targeted advertising, sale of personal information, and profiling with si...
TIPA-15	Universal Opt Out Signal Recognition	Controllers should plan for and implement recognition of widely accepted universal opt out signals, with documented desi...

Data Minimisation and Security

2 controls

Data Minimisation and Security

Controls in the Data Minimisation and Security domain of Tennessee Information Protection Act (TIPA) — 2 controls
Code	Title	Description
TIPA-09	Data Minimisation and Purpose Limitation	Controllers must limit collection to what is adequate, relevant, and reasonably necessary for disclosed purposes, and av...
TIPA-10	Security Programme Reasonableness	Controllers must implement reasonable administrative, technical, and physical safeguards appropriate to the volume and n...

Governance, Training and Records

3 controls

Governance, Training and Records

Controls in the Governance, Training and Records domain of Tennessee Information Protection Act (TIPA) — 3 controls
Code	Title	Description
TIPA-16	Internal Privacy Governance and Accountability	Controllers must designate privacy programme leadership, allocate resources, and report on programme performance to seni...
TIPA-17	Training and Workforce Awareness	Staff handling personal data must receive privacy training calibrated to their role, refreshed regularly, and supported...
TIPA-18	Audit and Documentation Retention	Controllers must retain assessments, contracts, consent records, and rights handling artefacts in a manner sufficient to...

Incident Response and Breach Notification

1 controls

Incident Response and Breach Notification

Controls in the Incident Response and Breach Notification domain of Tennessee Information Protection Act (TIPA) — 1 controls
Code	Title	Description
TIPA-14	Incident Response and Breach Notification Coordination	Controllers must integrate Tennessee breach notification rules into incident response, coordinate with the Attorney Gene...

NIST Alignment and Affirmative Defence

2 controls

NIST Alignment and Affirmative Defence

Controls in the NIST Alignment and Affirmative Defence domain of Tennessee Information Protection Act (TIPA) — 2 controls
Code	Title	Description
TIPA-02	NIST CSF Safe Harbour Alignment	TIPA provides an affirmative defence when the controller's privacy programme reasonably conforms to the NIST Privacy Fra...
TIPA-11	Affirmative Defence Documentation Package	Controllers seeking to rely on the NIST conformance affirmative defence should maintain a documentation package that can...

Notice and Transparency

1 controls

Notice and Transparency

Controls in the Notice and Transparency domain of Tennessee Information Protection Act (TIPA) — 1 controls
Code	Title	Description
TIPA-05	Privacy Notice and Disclosure Requirements	Privacy notices must include statutory disclosures, be reasonably accessible, and reflect actual processing, sharing, an...

Processors and Contracts

1 controls

Processors and Contracts

Controls in the Processors and Contracts domain of Tennessee Information Protection Act (TIPA) — 1 controls
Code	Title	Description
TIPA-08	Processor Obligations and Contracts	Controllers must bind processors via contract that addresses processing instructions, confidentiality, security, subproc...

Scope and Applicability

1 controls

Scope and Applicability

Controls in the Scope and Applicability domain of Tennessee Information Protection Act (TIPA) — 1 controls
Code	Title	Description
TIPA-01	Applicability Analysis and Effective Date Readiness	Controllers and processors must determine TIPA applicability against the revenue and processing thresholds, with readine...

Sensitive, Children and Teen Data

2 controls

Sensitive, Children and Teen Data

Controls in the Sensitive, Children and Teen Data domain of Tennessee Information Protection Act (TIPA) — 2 controls
Code	Title	Description
TIPA-06	Sensitive Data Consent	Processing of sensitive data including racial or ethnic origin, religious beliefs, mental or physical health diagnosis,...
TIPA-13	Children's and Teen Data Considerations	Controllers must respect heightened protections for minors, with age aware experiences and restrictions on targeted adve...

What is Tennessee Information Protection Act (TIPA) and who does it apply to?

Tennessee Information Protection Act (TIPA) is a compliance framework from United States — Tennessee with 10 domains and 18 controls. The Tennessee Information Protection Act (HB 1181, effective July 1, 2025) provides comprehensive consumer privacy rights. Applies to entities conducting business in Tennessee that control or process personal data of 175,000+ consumers, or 25,000+ consumers while deriving over 50% of gross revenue from data sales. Notable for affirmative defence for controllers maintaining privacy programs conforming to NIST Privacy Framework. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

What does Tennessee Information Protection Act (TIPA) actually require?

Tennessee Information Protection Act (TIPA) has 18 controls organised across 10 domains. The largest domains are Consumer Rights (3 controls), Governance, Training and Records (3 controls), Assessments and Profiling (2 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

If I already comply with another framework, how much of Tennessee Information Protection Act (TIPA) do I already cover?

Tennessee Information Protection Act (TIPA) does not currently have cross-framework mappings in our system. Check back as we continuously expand our mapping database.

How do I implement Tennessee Information Protection Act (TIPA)?

Start your Tennessee Information Protection Act (TIPA) compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about Tennessee Information Protection Act (TIPA) requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 18 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 686 frameworks.

Get Started Free →

Free forever — no credit card required