Tennessee’s New Information Protection Act: What It Means for Your Business

Tennessee is stepping up its commitment to data privacy with the passage of the Tennessee Information Protection Act (TIPA), which goes into effect on July 1, 2025. If your business collects or processes personal information from Tennessee residents, it’s important to understand how this new law may impact your operations.

TIPA is designed to give Tennessee consumers more control over their personal data. It also establishes clear guidelines for businesses on how to handle and protect that information. The law applies primarily to for-profit companies operating in the state or targeting Tennessee residents, especially those with annual gross revenues over $25 million and that handle large volumes of consumer data.

Under TIPA, consumers will have the right to know what personal information is being collected about them, request access to their data, ask for corrections or deletions, and opt out of the sale of their information or targeted advertising. For businesses, this means providing updated privacy notices, reviewing data collection practices, and ensuring there are processes in place to respond to these consumer requests.

A few key requirements for businesses include:

· Providing clear, accessible privacy notices to consumers

· Limiting data collection to what is necessary for your stated business purposes

· Implementing reasonable data security measures

· Obtaining consent before processing sensitive personal data

TIPA also requires businesses to conduct data protection assessments for certain high-risk activities and to have written agreements with any service providers that process data on their behalf.

Enforcement of the law will be handled by the Tennessee Attorney General’s office. If a business is found to be in violation, there are financial penalties, potentially up to $7,500 per violation. However, the law also recognizes that mistakes can happen. If your business can show that you’ve made a genuine effort to implement strong privacy and security practices, you may be able to avoid penalties by correcting issues within a set period.

With the compliance deadline approaching, now is the time to review your data privacy policies and practices. Taking proactive steps will not only help you avoid penalties, but also build trust with your customers in an era where data privacy is more important than ever.

If you have questions about how the Tennessee Information Protection Act may affect your business or need help preparing for compliance, our team is here to help. Please reach out to us for guidance and support.