Navigating the Tennessee Information Protection Act (TIPA): Key Details

Tennessee enacted the Tennessee Information Protection Act (TIPA), becoming one of the U.S. states with a comprehensive data privacy law. TIPA incorporates standard provisions found in other state data privacy laws but stands out by emphasizing an affirmative defense for organizations that adopt strict data privacy practices aligned with the NIST privacy framework.

TIPA is similar to data privacy laws in Virginia and Indiana but stricter in some aspects, such as granting Tennessee courts the authority to award treble damages for willful or knowing violations. The legislation received unanimous approval from the State General Assembly and was signed into law by Governor Bill Lee on May 11, 2023. It will take effect on July 1, 2025.

TIPA outlines several obligations for organizations, such as purpose limitation, non-discrimination, security measures, consent requirements and privacy notice requirements, and conducting data protection assessments, among several other requirements. It also provides data subjects with several rights, such as the right to access, correct, delete, portability, disclosure and opt-out.