Tennessee Information Protection Act (TIPA)

TIPA is Tennessee's comprehensive data privacy regulation, aligning with similar laws in other U.S. states.

While TIPA shares many provisions with similar laws in Virginia and Indiana, it is stricter in certain areas, such as damage awards for violations.

TIPA requires data controllers to limit personal information collection to what is adequate, relevant, and reasonably necessary for the purposes for which the data is processed.

TIPA requires the controllers to establish, implement, and maintain reasonable administrative, technical, and physical data security practices to protect the confidentiality, integrity, and accessibility of personal information.

Controllers must not process sensitive data concerning a consumer without obtaining the consumer's consent.

TIPA provides an affirmative defense for organizations that adhere to the National Institute of Standards and Technology (NIST) privacy framework, incentivizing strict data privacy measures.

Controllers must conduct data protection impact assessments (DPIAs).

Tennessee courts are authorized to award treble damages (triple the actual damages) for willful or knowing violations of the act.

TIPA provides data subjects with the right to access, right to correction, right to deletion, right to data portability, and the right to opt-out.

TIPA will come into effect on July 1, 2025.