Does Tennessee’s privacy law apply to your business?

The short answer

The Tennessee Information Protection Act (TIPA), Tenn. Code section 47-18-3301 and following, is Tennessee’s consumer privacy law. It took effect on July 1, 2025. It applies only to for-profit businesses that do business in Tennessee or target Tennessee residents, have more than $25 million in annual revenue, and either control or process personal information of at least 175,000 Tennessee consumers in a year, or of at least 25,000 consumers while earning more than half their revenue from selling personal information.

Most businesses with 10 to 100 employees will not meet those thresholds. They still have to follow Tennessee’s separate breach notification law, and they may inherit TIPA duties through contracts with larger clients. This article is general information, not legal advice. Confirm your status with a privacy lawyer.

A quick test: does TIPA apply to you?

1. Are you a for-profit business that does business in Tennessee or offers products or services to Tennessee residents? If not, TIPA likely does not apply.
2. Is your annual revenue more than $25 million? If not, TIPA does not apply to you directly.
3. Do you handle personal information of 175,000 or more Tennessee consumers a year? If yes, you are covered.
4. If fewer, is it at least 25,000 consumers, with more than 50 percent of revenue from selling personal information? If yes, you are covered.
5. Are you in an exempt category? Check the list below before assuming you are covered.

A consumer means a Tennessee resident acting in a personal or household context. People acting in a commercial or employment context are excluded, so a business-to-business company counting only client contacts and its own employees may never get close to the thresholds.

Who is exempt

Published analyses of the act list these entity-level exemptions:

• Tennessee state and local government bodies
• Financial institutions subject to Title V of the Gramm-Leach-Bliley Act
• HIPAA covered entities and business associates
• Nonprofit organizations
• Institutions of higher education
• Licensed insurance companies

Certain data is also exempt, including information covered by HIPAA, FERPA, the Fair Credit Reporting Act and the Driver’s Privacy Protection Act, along with publicly available and properly de-identified information.

What covered businesses must do

If TIPA applies, a controller (the business that decides why and how data is used) takes on these duties:

• Honor consumer rights. Tennessee consumers can confirm whether their data is processed and access it, correct it, delete it, get a portable copy and opt out of sales, targeted advertising and certain profiling.
• Respond on time. Requests must be answered without undue delay and within 45 days of receipt.
• Publish a privacy notice that explains what you collect, why and how people can use their rights.
• Get consent for sensitive data, such as health diagnoses, precise geolocation, biometric or genetic data used to identify someone, and data about children.
• Run data protection assessments for targeted advertising, sales of personal information, certain profiling, sensitive data and other high-risk processing.
• Sign processor contracts. Vendors that process data for you must work under a written data processing agreement.
• Maintain reasonable data security appropriate to the data.

Enforcement, penalties and the NIST defense

Only the Tennessee Attorney General can enforce TIPA. There is no private right of action. Before acting, the Attorney General must give written notice and a 60-day period to cure. Civil penalties can reach $7,500 per violation, and a court may award treble damages for willful or knowing violations.

TIPA has an unusual feature: an affirmative defense for businesses that create, maintain and follow a written privacy program that reasonably conforms to the NIST Privacy Framework or a comparable documented framework, kept up to date as the framework changes. The program is judged against the size and complexity of the business, the sensitivity of the data and the cost of available tools. For covered companies, documenting a framework-based program is the most practical risk reducer.

Not sure what personal data your systems hold or who can reach it? Our free Technology Health Assessment takes about 30 minutes of data collection. The next day you get a plain-language report on your cybersecurity, applications, integrations and business continuity, with a short list of next steps in order. It is yours to keep, with no obligation. Book your assessment.

If TIPA does not apply, what does?

Tennessee’s breach notification law

Every business that owns or licenses computerized personal information of Tennessee residents is subject to Tenn. Code section 47-18-2107. Key points:

• Notice to affected residents no later than 45 days after discovering or being notified of a breach, unless law enforcement requests a delay.
• A vendor that maintains data for you must tell you within 45 days of discovering a breach.
• If more than 1,000 residents are notified, the nationwide credit bureaus must be told.
• Personal information means a name combined with a Social Security number, driver’s license number, or a financial account or card number with the code needed to use it.
• Unlike many states, Tennessee lets an injured customer sue for damages under this statute.

Entities subject to HIPAA or the Gramm-Leach-Bliley Act are exempt from this statute and follow their federal rules instead.

Contracts with larger clients

This is where many small Tennessee businesses meet TIPA. If you provide marketing, software, billing, IT or staffing services to a covered company, that company must put you under a processor agreement. Expect clauses requiring confidentiality, deletion or return of data at the end of the contract, help with consumer requests and assessments, and proof of your security controls on request. You may be asked to complete a security questionnaire before renewal.

Other states and federal rules

If you serve consumers in other states, their privacy and breach laws may apply. Non-bank financial businesses also follow the FTC Safeguards Rule, which since May 13, 2024 requires reporting breaches involving 500 or more consumers to the FTC within 30 days of discovery.

Practical steps for a growing Tennessee business

1. Count Tennessee consumer records in your CRM, e-commerce platform and email lists once a year, and track revenue against the $25 million line.
2. List where personal data lives and delete what you no longer need.
3. Review your website privacy notice so it matches what you actually collect.
4. Prepare a short security summary for client questionnaires: MFA, encryption, access reviews, endpoint protection, backups.
5. Check that your own vendors have written data protection terms.
6. Write a breach plan that meets the 45-day Tennessee deadline.

JLB USA’s cybersecurity services cover the controls clients and regulators ask about, including MFA, access reviews, encryption, email security, monitored backups and a written recovery plan. We provide on-site IT in Chattanooga and remote support elsewhere; see our Chattanooga web design, marketing and IT page.

Keep reading

• How to set up DMARC, SPF and DKIM without breaking your email
• Is dark web monitoring worth it for a small business?
• Alabama Data Breach Notification Act: the 45-day rule and security duties
• Microsoft 365 security settings every small business should check in 2026

Related services

• Cybersecurity services
• Free Technology Health Assessment
• Chattanooga web design, marketing and IT