Law / United States / 
Tennessee
Tennessee Information Protection Act (TIPA), general applicability
Tenn. Code Ann. §§ 47-18-3201 to 47-18-3214
In force since .
A comprehensive regime rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, Data subject residence
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
What it requires
- Confirm TIPA's applicability thresholds and sector exemptions reach your business before assuming coverage or exemption either way.
- Use as TIPA's general effective date, not . An earlier engrossed print of the enacting bill carried the 2024 date, but the final signed Public Chapter moved it to 2025.
These lines are LexLint's reading of the law's text.
Who enforces it
Settledness
- As of
- Open questions
- Is the "twenty-five million dollars ($25,000,000) in revenue" test in Tenn. Code Ann. § 47-18-3202 measured on a person's worldwide revenue or only on revenue from Tennessee, and over which period?
What it makes you log
Who may demand the log
Regulator
What the log must hold
Decision basis
Logging duty
A controller must conduct and document a data protection assessment of each processing activity that involves targeted advertising, the sale of personal information, profiling that presents a reasonably foreseeable risk of injury, sensitive data, or a heightened risk of harm to consumers (section 47-18-3206(a)). The assessment weighs the benefits of the processing to the controller, the consumer, other stakeholders and the public against the risks to the consumer, as mitigated by safeguards (section 47-18-3206(b)). On a civil investigative demand the controller must make a relevant assessment available to the Attorney General and Reporter, and the assessment stays confidential and not open to public inspection (section 47-18-3206(c)). Section 47-18-3206(f) applies the duty to processing activities created or generated on or after . The text sets no period for keeping the assessment. A processor must give the controller the information needed to conduct and document the assessments (section 47-18-3205(a)(2)), which is a duty between the two parties and not a record the controller keeps. A controller that processes under an exemption bears the burden of demonstrating that the processing qualifies (section 47-18-3208(g)). Retaining a record of a deletion request is one of two routes to compliance for data obtained from another source (section 47-18-3203(a)(2)(C)), an option and not a duty. The written privacy policy of section 47-18-3213 is a rule statement and an affirmative defense, not a record. The Act's other sections name no log. The row cites the whole of sections 47-18-3201 to 47-18-3214, so it takes the Act's reach test: section 47-18-3202 applies the Act to persons that conduct business in the state producing products or services that target residents, and section 47-18-3201(7) defines a consumer as a resident.
- Kind
- Explicit
- As of
- Provision
- Tenn. Code Ann. 47-18-3206(a) and (c) (a documented data protection assessment of each heightened-risk processing activity, which the controller must make available to the Attorney General and Reporter on a civil investigative demand)
- Trigger
- personal_data_processing
What this law does
TIPA governs private-sector processing of Tennessee residents' personal information, enacted as House Bill 1181, Public Chapter 408 of the 113th General Assembly. The bill passed the House and was approved by the Governor in May 2023; a floor amendment moved the general effective date from an engrossed print's to the signed Public Chapter's , which the Secretary of State's official publication confirms as authoritative.
A separate data protection impact assessment look-back date, , is unaffected by the general effective-date correction.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .