US — TennesseeTennessee Information Protection Act (TIPA): Complete Compliance Guide
Overview
The Tennessee Information Protection Act (TIPA) is the state’s comprehensive data privacy legislation, signed into law on May 11, 2023, and effective starting July 1, 2025. TIPA grants consumers rights over their personal data and establishes obligations for businesses regarding the collection, processing, and protection of that data. Modeled after similar laws in Virginia and Utah, TIPA prioritizes transparency and consumer choice while excluding a private right of action.
Does the Tennessee Information Protection Act Apply to Your Business?
The TIPA applies to businesses that meet at least one of its thresholds. Use this tool to check whether it applies to yours.
Tennessee Information Protection Act Scope Checker
Answer three questions to determine whether the TIPA applies to your organization.
Note: the TIPA applies based on Tennessee residents' data, regardless of where your business is located.
Tennessee Consumer Rights Under the TIPA
The TIPA grants seven individual privacy rights to Tennessee residents. Businesses must respond to authenticated requests within 45 days. A 45-day extension is available with written notice to the consumer.
Request access to the information we have collected about you
45-day response windowCorrect inaccurate or incomplete information we have collected about you
45-day response windowDelete personal information we have collected about you
45-day response windowRequest a copy of personal information we have collected about you
45-day response windowRequest that we limit how your personal information being used
45-day response windowRequest that we stop selling your personal information
45-day response windowOpt-out of targeted advertisements so that you no longer receive personalized ads
45-day response windowHow Clym Helps You Comply with the Tennessee Information Protection Act
Configurable consent banner with a clear opt-out for targeted ads and data sales, and a full consent audit log.
Clym's Data Subject Request portal handles every TIPA request type, with built-in 45-day deadline tracking and escalation alerts.
Regulation Summary
- Enacted: May 11, 2023
- Effective: July 1, 2025
TIPA applies to businesses operating in Tennessee or targeting Tennessee residents and that:
- Control or process personal data of at least 100,000 consumers annually, or
- Control or process data of at least 25,000 consumers and derive over 50% of gross revenue from selling personal data.
- Government bodies and their contractors
- GLBA-covered financial institutions
- HIPAA-covered entities and associates
- Nonprofits and higher education institutions
- De-identified or publicly available data
- Limit data collection to what’s necessary and relevant
- Use data only for disclosed purposes
- Provide clear and accessible privacy notices
- Use reasonable security measures
- Obtain consumer consent for processing sensitive data, including racial or ethnic origin, health data, biometric and genetic data, and precise geolocation
- Respond to consumer requests within 45 days, with a one-time 45-day extension when necessary
- Publish a privacy notice explaining data uses and consumer rights
- Enable opt-out mechanisms for sales or targeted ads
- Include links to exercise consumer rights
- Conduct data protection assessments for high-risk processing activities
- Ensure contracts with processors define confidentiality, responsibilities, and processing limitations
- Implement technical and organizational safeguards
- Provide employee training on privacy and security measures
Consumers may:
- Access their data
- Correct inaccuracies
- Delete personal data
- Obtain a copy in a portable, structured, machine-readable format
- Opt out of data sales, targeted ads, and profiling
- Authority: Tennessee Attorney General
- Penalties: Up to $7,500 per violation
- Cure Period: 60 days until July 1, 2026; not guaranteed afterward
- Private Right of Action: Not provided