Tennessee Information Protection Act, Attorney General enforcement and NIST safe harbor

Tenn. Code Ann. §§ 47-18-3201 to 47-18-3214

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 1 July 2025.

An enforcement supervision rule binding private bodies.

As of 27 August 2026.

What it requires

Expect TIPA violations to be enforced exclusively by the Tennessee Attorney General and Reporter, never by a private plaintiff or class action.
Consider creating, maintaining, and complying with a written privacy program reasonably conforming to the NIST privacy framework. TIPA grants an affirmative defense to a controller or processor that does so, a safe harbor no other state offers this directly.
Expect a mandatory 60-day cure notice before an enforcement action, with no sunset date found in the statute's text.

If you get it wrong

Private right of actionNo

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

TIPA is enforced exclusively by the Tennessee Attorney General and Reporter, who must provide a controller or processor 60 days' written notice identifying the specific violated provisions before suing; this cure notice is mandatory, not discretionary, and the text carries no sunset clause anywhere, unlike Maryland's and Minnesota's expiring cure mechanisms. A court may award relief to each affected consumer regardless of actual damages, and treble damages for a willful or knowing violation.

TIPA's own compliance-program provision requires a written privacy program reasonably conforming to the NIST privacy framework, and grants an affirmative defense to liability for a controller or processor that creates, maintains, and complies with such a program, a structural feature no other state ties to liability this directly. TIPA bars any private right of action, including a class action, under TIPA or other law.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot
automated_outreach

Read the law

official Tennessee session law text, Public Chapter 408 (2023), Tennessee Secretary of State

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app