The Tennessee Information Protection Act

Tennessee is joining the data privacy movement with the Tennessee Information Protection Act (TIPA), which takes effect on July 1, 2025. This comprehensive law grants Tennessee residents new rights regarding their personal information and imposes obligations on businesses that handle their data.

Key Provisions of the TIPA:

  • Consumer Rights:

    • Right to Access: Consumers can request access to their personal data.

    • Right to Correction: Consumers can request correction of inaccurate personal data.

    • Right to Deletion: Consumers can request deletion of their personal data.

    • Right to Opt-Out: Consumers can opt-out of the processing of their personal data for purposes of targeted advertising and sale.

    • Right to Data Portability: Consumers can request a copy of their personal data in a portable format.

  • Business Obligations:

    • Provide a Privacy Notice: Clearly inform consumers about your data practices.

    • Respond to Consumer Requests: Respond to consumer requests within 45 days.

    • Implement Reasonable Security: Protect personal data with appropriate security measures.

    • Conduct Data Protection Assessments: Assess risks for processing activities like targeted advertising, profiling, and the processing of sensitive data.

    • Obtain Consent: Obtain consent before processing sensitive data.

  • Sensitive Data:

    • The TIPA does not define specific categories of sensitive data but requires controllers to take "reasonable measures" to secure personal data.

  • Data Minimization:

    • The TIPA emphasizes data minimization, requiring businesses to limit the collection of personal data to what is "adequate, relevant, and reasonably necessary" for the specified purposes.

Who does the TIPA apply to?

The TIPA applies to businesses that conduct business in Tennessee or provide products or services to Tennessee residents and meet one of the following thresholds:

  • Control or process the personal data of at least 25,000 consumers.

  • Derive 25% or more of their gross revenue from selling personal data and control or process the personal data of at least 25,000 consumers.

Why is the TIPA important?

The TIPA is a significant step in protecting consumer data privacy in Tennessee. It's essential for businesses to understand and comply with the TIPA to avoid legal and financial risks, build trust with customers, and foster a culture of responsible data handling.

How Aetos Can Help:

Aetos Data Consulting provides expert guidance and support to help businesses navigate the complexities of the TIPA. Our services include:

  • TIPA compliance audits

  • Policy development and implementation

  • Training and awareness programs

  • Data subject request management

Contact us today to learn more about how we can help your business achieve and maintain TIPA compliance.

Check out other state laws