Tennessee Privacy Law Attorneys

Tennessee Privacy Law Overview

Tennessee's privacy law took effect July 1, 2025 and is notable for its NIST-based affirmative defense — the only one of its kind among state privacy laws. Its high thresholds (a $25 million revenue floor plus large consumer counts) mean it applies mainly to bigger companies, but those companies gain a clear compliance roadmap and a litigation shield if they follow it.

The Tennessee Information Protection Act (TIPA)

Tennessee's law provides comprehensive consumer rights with opt-in consent for sensitive data, but applies only to larger businesses (over $25 million in revenue and high consumer counts). Its signature feature is an affirmative defense: a business that maintains a written privacy program conforming to the NIST Privacy Framework can use that program as a defense to enforcement.

Who Must Comply

The TIPA applies to businesses that meet Tennessee's applicability thresholds:

• Annual revenue exceeding $25 million, and
• Controls or processes data of 175,000+ Tennessee consumers, or 25,000+ consumers with over 50% of revenue from selling data

What makes Tennessee different: Tennessee is the only state to offer an affirmative defense for businesses that follow the NIST Privacy Framework, and it allows treble damages for willful violations.

Consumer Rights Under the TIPA

Tennessee residents can exercise the following rights over their personal data:

• Right to access / confirm what data is held
• Right to correct inaccurate data
• Right to delete personal data
• Right to data portability
• Right to opt out of targeted advertising
• Right to opt out of the sale of personal data
• Right to opt out of profiling for significant decisions

Sensitive personal data: Businesses must obtain opt-in consent before processing sensitive data (such as health, biometric, precise-geolocation, or demographic data).

Data Breach Notification in Tennessee

Tennessee requires notice to affected residents within 45 days of discovery; private businesses are generally not required to notify the Attorney General.

• Deadline to notify residents: No later than 45 days after discovery of the breach
• Attorney General notice: Tennessee does not impose a separate Attorney General notice duty on most private businesses
• Covered data: Name combined with sensitive identifiers (SSN, driver's license, financial-account or medical information, and more)

Federal Privacy Laws That Apply in Tennessee

Even where Tennessee law is silent, residents and businesses are covered by federal privacy statutes:

• HIPAA — health information held by providers, plans and their vendors
• GLBA — privacy and safeguards rules for financial institutions
• FERPA — student education records
• FCRA — consumer reporting agencies and background screening
• COPPA — online collection of data from children under 13
• FTC Act §5 — unfair or deceptive privacy and data-security practices

Tennessee Privacy Law FAQ

How a Tennessee Privacy Attorney Can Help