Meet Tennessee TIPA privacy duties with a NIST-aligned programme

The Tennessee Information Protection Act (TIPA) is Tennessee's comprehensive consumer privacy law, codified at Tenn. Code Ann. sections 47-18-3201 to 47-18-3213. It took effect on 1 July 2025. It gives Tennessee residents rights over their personal information, including access, correction, deletion, portability and opting out of sale, targeted advertising and significant profiling, and places transparency, security and assessment duties on businesses that control or process that information.

TIPA applies to businesses that operate in Tennessee or target its residents, have more than $25 million in revenue, and either process personal information of at least 175,000 consumers in a calendar year or of at least 25,000 consumers while earning over 50% of gross revenue from selling it. Government bodies, GLBA financial institutions, licensed insurers, HIPAA covered entities and business associates, nonprofits and higher education institutions are exempt.

A court can impose civil penalties of up to $7,500 for each violation of TIPA, and may award treble damages if the violation was wilful or knowing. Only the Tennessee Attorney General and Reporter can enforce the law, and there is no private right of action. Before suing, the Attorney General must give 60 days' written notice, and the business can avoid action by curing the violation and confirming this in writing.

TIPA gives Tennessee consumers the right to confirm whether their personal information is processed and to access it, to correct inaccuracies, to delete it, and to obtain a portable copy. Consumers can also opt out of the sale of their personal information, targeted advertising and profiling that produces legal or similarly significant effects. Controllers must respond within 45 days, extendable once by 45 days, and offer a free appeal process.

TIPA gives controllers and processors an affirmative defence if they create, maintain and comply with a written privacy programme that reasonably conforms to the NIST Privacy Framework version 1.0, or other documented policies designed to safeguard consumer privacy, and that provides the rights TIPA requires. The programme must be updated within two years of a new framework revision. Its scale is judged on business size, activities, data sensitivity and cost.

TIPA follows the model of other US state laws such as Virginia's, with similar consumer rights, sensitive data consent, processor contracts and data protection assessments. It differs by adding a $25 million revenue threshold and a NIST Privacy Framework affirmative defence. Compared with GDPR, it is narrower: it covers only in-scope businesses and Tennessee consumers, relies on opt-out for most processing and has no private right of action.

To comply with TIPA, confirm whether you meet its thresholds, map the personal information you process, and publish a privacy notice covering categories, purposes, sales and how to exercise rights. Set up request and appeal handling within the 45-day deadline, obtain consent before processing sensitive data, put compliant contracts in place with processors, carry out data protection assessments and maintain reasonable security. A NIST-aligned privacy programme also supports the affirmative defence.

Yes. TIPA is supported in OneClickComply today. We link its requirements to controls you may already run for frameworks such as the NIST Privacy Framework, ISO 27001 or SOC 2, generate privacy policies, collect security evidence automatically and give access to our in-house audit team. OneClickComply does not certify compliance, but helps you build and evidence your programme.