Tennessee Privacy Law

Tennessee (TIPA)

Last updated Sep 29, 2026

TIPA Enacted, in effect

Who this affects: This page tracks Tennessee’s TIPA, which governs controllers and processors.

Who it applies to: Persons that do business in Tennessee with products or services targeting its residents, and meet: 25,000+ consumers and more than $25,000,000 in revenue and more than 50% of gross revenue from selling data, or 175,000+ consumers and more than $25,000,000 in revenue.

Content on this page is not legal advice

Must, Can't, Should TIPA Timeline

July 1, 2025

Effective ↗

Attorney General

Enforced by ↗

$7,500

Maximum penalty per violation ↗

None

Private right of action ↗

The law, in plain English

Must · Can’t · Should

TIPA, distilled to what actually changes your week. Read one column to know your floor, your hard limits, and the further obligations and good practices worth planning for.

Must

Respond to authenticated consumer requests within 45 days, and give notice of any extension and its reason within that period. DataGrail editorial summary: our plain-English wording, written from the sources below, not statutory text. Tenn. Code Ann. § 47-18-3304 (enacted as Pub. Ch. 408 § 47-18-3203) “A controller shall comply with an authenticated consumer request to exercise the right to” Read the statute Tenn. Code Ann. § 47-18-3304 (enacted as Pub. Ch. 408 § 47-18-3203) “A controller shall respond to the consumer without undue delay, but in all cases within forty-five (45) days of receipt of a request submitted pursuant to subsection (a)” Read the statute Tenn. Code Ann. § 47-18-3304 (enacted as Pub. Ch. 408 § 47-18-3203) “so long as the controller informs the consumer of the extension within the initial forty-five-day response period, together with the reason for the extension” Read the statute
Establish an appeal process, explain any refusal with appeal steps within 45 days, and answer appeals in writing within 60 days. DataGrail editorial summary: our plain-English wording, written from the sources below, not statutory text. Tenn. Code Ann. § 47-18-3304 (enacted as Pub. Ch. 408 § 47-18-3203) “A controller shall establish a process for a consumer to appeal the controller's refusal to take action on a request within a reasonable period of time after the consumer's receipt of the decision pursuant to subdivision (b)(2).” Read the statute Tenn. Code Ann. § 47-18-3304 (enacted as Pub. Ch. 408 § 47-18-3203) “the controller shall inform the consumer without undue delay, but in all cases and at the latest within forty-five (45) days of receipt of the request, of the justification for declining to take action and instructions for how to appeal the decision” Read the statute Tenn. Code Ann. § 47-18-3304 (enacted as Pub. Ch. 408 § 47-18-3203) “Within sixty (60) days of receipt of an appeal, a controller shall inform the consumer in writing of action taken or not taken in response to the appeal” Read the statute
Provide a clear, accessible privacy notice describing secure and reliable means for consumers to submit rights requests. DataGrail editorial summary: our plain-English wording, written from the sources below, not statutory text. Tenn. Code Ann. § 47-18-3305 (enacted as Pub. Ch. 408 § 47-18-3204) “A controller shall provide a reasonably accessible, clear, and meaningful privacy notice that includes” Read the statute Tenn. Code Ann. § 47-18-3305 (enacted as Pub. Ch. 408 § 47-18-3204) “A controller shall provide, and shall describe in a privacy notice, one (1) or more secure and reliable means for a consumer to submit a request to exercise the consumer rights in § 47-18-3203” Read the statute

Can't

Process sensitive data without the consumer's consent, or a known child's sensitive data other than in accordance with COPPA. DataGrail editorial summary: our plain-English wording, written from the sources below, not statutory text. Tenn. Code Ann. § 47-18-3305 (enacted as Pub. Ch. 408 § 47-18-3204) “Not process sensitive data concerning a consumer without obtaining the consumer's consent, or, in the case of the processing of sensitive data concerning a known child, without processing the data in accordance with the federal Children's Online Privacy Protection Act (15 U.S.C. § 6501 et seq.) and its implementing regulations” Read the statute
Discriminate for exercising rights, like denying goods or charging different prices, except opt-out or loyalty-program offers. DataGrail editorial summary: our plain-English wording, written from the sources below, not statutory text. Tenn. Code Ann. § 47-18-3305 (enacted as Pub. Ch. 408 § 47-18-3204) “A controller shall not discriminate against a consumer for exercising the consumer rights contained in this part, including denying goods or services, charging different prices or rates for goods or services, or providing a different level of quality of goods and services to the consumer. However, this subdivision (a)(5) does not require a controller to provide a product or service that requires the personal information of a consumer that the controller does not collect or maintain, or prohibit a controller from offering a different price, rate, level, quality, or selection of goods or services to a consumer, including offering goods or services for no fee, if the consumer has exercised the right to opt out pursuant to§ 47-18-3203(a)(2)(F) or the offer is related to a consumer's voluntary participation in a bona fide loyalty, rewards, premium features, discounts, or club card program” Read the statute
Require consumers to create a new account to exercise their rights, or rely on contract terms that waive or limit those rights. DataGrail editorial summary: our plain-English wording, written from the sources below, not statutory text. Tenn. Code Ann. § 47-18-3305 (enacted as Pub. Ch. 408 § 47-18-3204) “A controller shall not require a consumer to create a new account in order to exercise consumer rights in § 47-18-3203” Read the statute Tenn. Code Ann. § 47-18-3305 (enacted as Pub. Ch. 408 § 47-18-3204) “A provision of a contract or agreement that purports to waive or limit the consumer rights described in § 47-18-3203 is contrary to public policy and is void and unenforceable” Read the statute

Should

Keep data protection assessments documented and ready to produce on an attorney general civil investigative demand. DataGrail editorial summary: our plain-English wording, written from the sources below, not statutory text. Tenn. Code Ann. § 47-18-3307 (enacted as Pub. Ch. 408 § 47-18-3206) “A controller shall conduct and document a data protection assessment of each of the following processing activities involving personal information” Read the statute Tenn. Code Ann. § 47-18-3307 (enacted as Pub. Ch. 408 § 47-18-3206) “The attorney general and reporter may request pursuant to a civil investigative demand that a controller disclose a data protection assessment that is relevant to an investigation conducted by the attorney general and reporter” Read the statute
Sign a binding contract with each processor covering instructions, purpose, data type, duration, and both parties' obligations. DataGrail editorial summary: our plain-English wording, written from the sources below, not statutory text. Tenn. Code Ann. § 47-18-3306 (enacted as Pub. Ch. 408 § 47-18-3205) “A contract between a controller and a processor governs the processor's data processing procedures with respect to processing performed on behalf of the controller. The contract is binding and must clearly set forth instructions for processing data, the nature and purpose of processing, the type of data subject to processing, the duration of processing, and the rights and obligations of both parties.” Read the statute
Map collection to disclosed purposes, keep it reasonably necessary, and get consent before any incompatible new use. DataGrail editorial summary: our plain-English wording, written from the sources below, not statutory text. Tenn. Code Ann. § 47-18-3305 (enacted as Pub. Ch. 408 § 47-18-3204) “Limit the collection of personal information to what is adequate, relevant, and reasonably necessary in relation to the purposes for which the data is processed, as disclosed to the consumer” Read the statute Tenn. Code Ann. § 47-18-3305 (enacted as Pub. Ch. 408 § 47-18-3204) “not process personal information for purposes that are beyond what is reasonably necessary to and compatible with the disclosed purposes for which the personal information is processed, as disclosed to the consumer, unless the controller obtains the consumer's consent” Read the statute

These are the highlights we judge most important, not everything TIPA requires. The comprehensive law section below covers the full detail, fact by fact, with the statutory text behind every one.

The comprehensive law

Tennessee Information Protection Act

TIPA (HB 1181) is Tennessee’s comprehensive privacy law. Every fact was extracted from the primary statute by the DataGrail regulation engine and is grounded to the cited source. Scan the facts; the exact statutory text sits one click away on each source link.

Status

Enacted, in effect

Archived excerpt — the text we read …ce purposes only and do not constitute a part of the law enacted by this act. However, the Tennessee Code Commission is requested to include the headings in any compilation or publication containing this act. SECTION 6. This act takes effect July 1, 2025, the public welfare requiring it. Archived from source — captured 2026-08-03 · snapshot 2bba6177 Verify at the source

Corroborated by Privacy-law tracker

Effective

July 1, 2025

Corroborated by Privacy-law tracker Regulator guidance

Signed

May 11, 2023

“Signed by Governor.05/11/2023” View the source

Enforced by

Attorney General and Reporter

Archived excerpt — the text we read 47-18-3212. Enforcement- Civil penalty- Expenses. (a) The attorney general and reporter has exclusive authority to enforce this part. (b) The attorney general and reporter may develop reasonable cause to believe that a controller or processor is in violation of this part, based on the attorney general and reporter's own inquiry or on consumer or publi… Archived from source — captured 2026-08-03 · snapshot 2bba6177 Tenn. Code Ann. § 47-18-3313 — Enacted as Pub. Ch. 408 § 47-18-3212. Verify at the source

Maximum penalty per violation

$7,500

Courts may award treble damages for willful or knowing violations. A NIST-conforming privacy program is a defense. “A court may impose a civil penalty of up to seven thousand five hundred dollars ($7,500) for each violation of this part.” Tenn. Code Ann. § 47-18-3313 — Enacted as Pub. Ch. 408 § 47-18-3212. View the statute

Right to cure

60 days

Archived excerpt — the text we read …ttorney general and reporter shall provide a controller or processor sixty-days' written notice identifying the specific provisions of this part the attorney general and reporter alleges have been or are being violated. If within the sixtyday period, the controller or processor cures the noticed violation and provides the attorney general and reporter an express written statement that the alleged violations have been cured and that no such further violations shall occur, then the attorney general and reporter shall not initiate an action against the controller or processor. (c) If a controller or processor continues to violate this part following the cure period in subsection (b) or breaches an express written statement provided to the attorney general and reporter under subsection (b), th… Archived from source — captured 2026-08-03 · snapshot 2bba6177 Tenn. Code Ann. § 47-18-3313 — Enacted as Pub. Ch. 408 § 47-18-3212. Verify at the source

Private right of action

No private right of action.

Archived excerpt — the text we read …ve hundred dollars ($7,500) for each violation of this part. (2) If the court finds the controller or processor willfully or knowingly violated this part, then the court may, in its discretion, award treble damages. (e) A violation of this part shall not serve as the basis for, or be subject to, a private right of action, including a class action lawsuit, under this part or other law. (f) The attorney general and reporter may recover reasonable expenses incurred in investigating and preparing a case, including attorney fees, in an action initiated under this part. Archived from source — captured 2026-08-03 · snapshot 2bba6177 Tenn. Code Ann. § 47-18-3313 — Enacted as Pub. Ch. 408 § 47-18-3212. Verify at the source

Corroborated by Privacy-law tracker Regulator guidance

Universal opt-out signal

Not required

Corroborated by Privacy-law tracker

What the law gives consumers

Right to access Archived excerpt — the text we read …ant to subdivision (a)(2) on behalf of the child regarding processing personal information belonging to the known child. (2) A controller shall comply with an authenticated consumer request to exercise the right to: (A) Confirm whether a controller is processing the consumer's personal information and to access the personal information; (B) Correct inaccuracies in the consumer's personal information, taking into account the nature of the personal information and the purposes of the processing of the consumer's personal information; (C) Delete personal… Archived from source — captured 2026-08-03 · snapshot 2bba6177 Tenn. Code Ann. § 47-18-3304 — Enacted as Pub. Ch. 408 § 47-18-3203. Verify at the source
Right to correct Archived excerpt — the text we read …) A controller shall comply with an authenticated consumer request to exercise the right to: (A) Confirm whether a controller is processing the consumer's personal information and to access the personal information; (B) Correct inaccuracies in the consumer's personal information, taking into account the nature of the personal information and the purposes of the processing of the consumer's personal information; (C) Delete personal information provided by or obtained about the consumer. A controller is not required to delete information that it maintains or uses as aggregate or de-identified data; provided, that such data in t… Archived from source — captured 2026-08-03 · snapshot 2bba6177 Tenn. Code Ann. § 47-18-3304 — Enacted as Pub. Ch. 408 § 47-18-3203. Verify at the source
Right to delete Archived excerpt — the text we read …nal information; (B) Correct inaccuracies in the consumer's personal information, taking into account the nature of the personal information and the purposes of the processing of the consumer's personal information; (C) Delete personal information provided by or obtained about the consumer. A controller is not required to delete information that it maintains or uses as aggregate or de-identified data; provided, that such data in the possession of the controller is not linked to a specific consumer. A cont… Archived from source — captured 2026-08-03 · snapshot 2bba6177 Tenn. Code Ann. § 47-18-3304 — Enacted as Pub. Ch. 408 § 47-18-3203. Verify at the source
Right to data portability Archived excerpt — the text we read …sing such retained personal information for any purpose prohibited under this part; or (ii) Opting the consumer out of the processing of such personal data for any purpose except for those exempted under this part; (D) Obtain a copy of the consumer's personal information that the consumer previously provided to the controller in a portable and, to the extent technically feasible, readily usable format that allows the consumer to transmit the data to another controller without hindrance, where the processing is carried out by automated means; or (E) Opt out of a controller's processing of personal information for purp… Archived from source — captured 2026-08-03 · snapshot 2bba6177 Tenn. Code Ann. § 47-18-3304 — Enacted as Pub. Ch. 408 § 47-18-3203. Verify at the source
Right to opt out of sale Archived excerpt — the text we read …the consumer to transmit the data to another controller without hindrance, where the processing is carried out by automated means; or (E) Opt out of a controller's processing of personal information for purposes of: (i) Selling personal information about the consumer; (ii) Targeted advertising; or (iii) Profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer. (b) Except as otherwise provided in this part, a controller shall c… Archived from source — captured 2026-08-03 · snapshot 2bba6177 Tenn. Code Ann. § 47-18-3304 — Enacted as Pub. Ch. 408 § 47-18-3203. Verify at the source
Right to opt out of targeted advertising Archived excerpt — the text we read …r without hindrance, where the processing is carried out by automated means; or (E) Opt out of a controller's processing of personal information for purposes of: (i) Selling personal information about the consumer; (ii) Targeted advertising; or (iii) Profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer. (b) Except as otherwise provided in this part, a controller shall comply with an authenticated… Archived from source — captured 2026-08-03 · snapshot 2bba6177 Tenn. Code Ann. § 47-18-3304 — Enacted as Pub. Ch. 408 § 47-18-3203. Verify at the source
Right to opt out of profiling for significant decisions Archived excerpt — the text we read …processing is carried out by automated means; or (E) Opt out of a controller's processing of personal information for purposes of: (i) Selling personal information about the consumer; (ii) Targeted advertising; or (iii) Profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer. (b) Except as otherwise provided in this part, a controller shall comply with an authenticated request by a consumer to exercise the consumer rights authorized pursuant to subdivision (a)(2) as follows: (1) A controlle… Archived from source — captured 2026-08-03 · snapshot 2bba6177 Tenn. Code Ann. § 47-18-3304 — Enacted as Pub. Ch. 408 § 47-18-3203. Verify at the source
Sensitive data: opt-in consent required Archived excerpt — the text we read …exercised the right to opt out pursuant to§ 47-18-3203(a)(2)(F) or the offer is related to a consumer's voluntary participation in a bona fide loyalty, rewards, premium features, discounts, or club card program; and (6) Not process sensitive data concerning a consumer without obtaining the consumer's consent, or, in the case of the processing of sensitive data concerning a known child, without processing the data in accordance with the federal Children's Online Privacy Protection Act (15 U.S.C. § 6501 et seq.) and its implementing regulations. (b) A provision of a contract or agreement that purports to waive or limit the consumer rights described in § 47-18-3203 is contrary to public policy and is void and unenforceable. (c) A controller shall provide a reaso… Archived from source — captured 2026-08-03 · snapshot 2bba6177 Tenn. Code Ann. § 47-18-3305 — Enacted as Pub. Ch. 408 § 47-18-3204. Verify at the source
Right to appeal Archived excerpt — the text we read …ired to comply with a request to initiate an action under subsection (a) and may request that the consumer provide additional information reasonably necessary to authenticate the consumer and the consumer's request. (c) A controller shall establish a process for a consumer to appeal the controller's refusal to take action on a request within a reasonable period of time after the consumer's receipt of the decision pursuant to subdivision (b)(2). The appeal process must be made available to the consumer in a conspicuous manner, must be available at no cost to the consumer, … Archived from source — captured 2026-08-03 · snapshot 2bba6177 Tenn. Code Ann. § 47-18-3304 — Enacted as Pub. Ch. 408 § 47-18-3203. Verify at the source
Right against discrimination Archived excerpt — the text we read …that such data in the possession of the business is not linked to a specific consumer; (5) Not process personal information in violation of state and federal laws that prohibit unlawful discrimination against consumers. A controller shall not discriminate against a consumer for exercising the consumer rights contained in this part, including denying goods or services, charging different prices or rates for goods or services, or providing a different level of quality of goods and services to the consumer. However, this subdivision (a)(5) does not … Archived from source — captured 2026-08-03 · snapshot 2bba6177 Tenn. Code Ann. § 47-18-3305 — Enacted as Pub. Ch. 408 § 47-18-3204. Verify at the source
Not granted: Private right of action Archived excerpt — the text we read …ve hundred dollars ($7,500) for each violation of this part. (2) If the court finds the controller or processor willfully or knowingly violated this part, then the court may, in its discretion, award treble damages. (e) A violation of this part shall not serve as the basis for, or be subject to, a private right of action, including a class action lawsuit, under this part or other law. (f) The attorney general and reporter may recover reasonable expenses incurred in investigating and preparing a case, including attorney fees, in an action initiated under this part. Archived from source — captured 2026-08-03 · snapshot 2bba6177 Tenn. Code Ann. § 47-18-3313 — Enacted as Pub. Ch. 408 § 47-18-3212. Verify at the source

Who the law governs

Controllers Archived excerpt — the text we read …firmative action; (7) "Consumer": (A) Means a natural person who is a resident of this state acting only in a personal context; and (B) Does not include a natural person acting in a commercial or employment context; (8) "Controller" means the natural or legal person that, alone or jointly with others, determines the purpose and means of processing personal information; (9) "Covered entity" has the same meaning as defined by HIPAA; (10) "Decisions that produce legal or similarly significant effects concerning the consumer" means decisions made by the controller that result in the prov… Archived from source — captured 2026-08-03 · snapshot 2bba6177 Tenn. Code Ann. § 47-18-3302 — Enacted as Pub. Ch. 408 § 47-18-3201. Verify at the source
Processors Archived excerpt — the text we read …rmed, whether by manual or automated means, on personal information or on sets of personal information, such as the collection, use, storage, disclosure, analysis, deletion, or modification of personal information; (20) "Processor" means a natural or legal entity that processes personal information on behalf of a controller; (21) "Profiling" means a form of solely automated processing performed on personal information to evaluate, analyze, or predict personal aspects related to an identified or identifiable natural person's economic situat… Archived from source — captured 2026-08-03 · snapshot 2bba6177 Tenn. Code Ann. § 47-18-3302 — Enacted as Pub. Ch. 408 § 47-18-3201. Verify at the source

Exemptions

State and local government bodies Archived excerpt — the text we read 47-18-3210. Exemptions. (a) This part does not apply to: (1) A body, authority, board, bureau, commission, district, or agency of this state or of a political subdivision of this state; (2) A financial institution, an affiliate of a financial institution, or data subject to Title V of the federal Gramm-Leach-Bliley Act (15 U.S.C. § 6801 et seq.); (3) An individual, firm, association, corporation, or o… Archived from source — captured 2026-08-03 · snapshot 2bba6177 Tenn. Code Ann. § 47-18-3311 — Enacted as Pub. Ch. 408 § 47-18-3210. Verify at the source
GLBA: financial institutions, their affiliates, and data subject to Title V Entity- and data-level Archived excerpt — the text we read 47-18-3210. Exemptions. (a) This part does not apply to: (1) A body, authority, board, bureau, commission, district, or agency of this state or of a political subdivision of this state; (2) A financial institution, an affiliate of a financial institution, or data subject to Title V of the federal Gramm-Leach-Bliley Act (15 U.S.C. § 6801 et seq.); (3) An individual, firm, association, corporation, or other entity that is licensed in this state under title 56 as an insurance company and transacts insurance business; (4) A covered entity or business associate gove… Archived from source — captured 2026-08-03 · snapshot 2bba6177 Tenn. Code Ann. § 47-18-3311 — Enacted as Pub. Ch. 408 § 47-18-3210. Verify at the source
Licensed insurance companies Archived excerpt — the text we read …s state or of a political subdivision of this state; (2) A financial institution, an affiliate of a financial institution, or data subject to Title V of the federal Gramm-Leach-Bliley Act (15 U.S.C. § 6801 et seq.); (3) An individual, firm, association, corporation, or other entity that is licensed in this state under title 56 as an insurance company and transacts insurance business; (4) A covered entity or business associate governed by the privacy, security, and breach notification rules issued by the United States department of health and human services, 45 CFR Parts 160 and 164 established purs… Archived from source — captured 2026-08-03 · snapshot 2bba6177 Tenn. Code Ann. § 47-18-3311 — Enacted as Pub. Ch. 408 § 47-18-3210. Verify at the source
HIPAA covered entities and business associates Archived excerpt — the text we read …Leach-Bliley Act (15 U.S.C. § 6801 et seq.); (3) An individual, firm, association, corporation, or other entity that is licensed in this state under title 56 as an insurance company and transacts insurance business; (4) A covered entity or business associate governed by the privacy, security, and breach notification rules issued by the United States department of health and human services, 45 CFR Parts 160 and 164 established pursuant to HIPAA, and the federal Health Information Technology for Economic and Clinical Health Act (P.L. 111-5); (5) A nonprofit organization; (6) An institution of higher education; (7) Protected health information under HIPAA; (8) Health records for purposes of title 68; (9) Patient identifying information for purposes of 42 U.… Archived from source — captured 2026-08-03 · snapshot 2bba6177 Tenn. Code Ann. § 47-18-3311 — Enacted as Pub. Ch. 408 § 47-18-3210. Verify at the source
Nonprofit organizations, broadly defined Tennessee Nonprofit Corporation Act corporations; organizations tax-exempt under 26 U.S.C. §§ 501-530; public utilities organized or regulated under Tennessee law; and entities owned or controlled by a nonprofit organization. "or regulated" added by Pub. Ch. 201 (2025), eff. July 1, 2025. Archived excerpt — the text we read … by the United States department of health and human services, 45 CFR Parts 160 and 164 established pursuant to HIPAA, and the federal Health Information Technology for Economic and Clinical Health Act (P.L. 111-5); (5) A nonprofit organization; (6) An institution of higher education; (7) Protected health information under HIPAA; (8) Health records for purposes of title 68; (9) Patient identifying information for purposes of 42 U.S.C. § 290dd-2; (10) Personal … Archived from source — captured 2026-08-03 · snapshot 2bba6177 Tenn. Code Ann. § 47-18-3311 — Enacted as Pub. Ch. 408 § 47-18-3210. Verify at the source
Institutions of higher education Archived excerpt — the text we read …nt of health and human services, 45 CFR Parts 160 and 164 established pursuant to HIPAA, and the federal Health Information Technology for Economic and Clinical Health Act (P.L. 111-5); (5) A nonprofit organization; (6) An institution of higher education; (7) Protected health information under HIPAA; (8) Health records for purposes of title 68; (9) Patient identifying information for purposes of 42 U.S.C. § 290dd-2; (10) Personal information: (A) Processed for purposes … Archived from source — captured 2026-08-03 · snapshot 2bba6177 Tenn. Code Ann. § 47-18-3311 — Enacted as Pub. Ch. 408 § 47-18-3210. Verify at the source
Protected health information under HIPAA Archived excerpt — the text we read …Parts 160 and 164 established pursuant to HIPAA, and the federal Health Information Technology for Economic and Clinical Health Act (P.L. 111-5); (5) A nonprofit organization; (6) An institution of higher education; (7) Protected health information under HIPAA; (8) Health records for purposes of title 68; (9) Patient identifying information for purposes of 42 U.S.C. § 290dd-2; (10) Personal information: (A) Processed for purposes of: (i) Research conducted in accordance with … Archived from source — captured 2026-08-03 · snapshot 2bba6177 Tenn. Code Ann. § 47-18-3311 — Enacted as Pub. Ch. 408 § 47-18-3210. Verify at the source
Health records under title 68 Archived excerpt — the text we read …A, and the federal Health Information Technology for Economic and Clinical Health Act (P.L. 111-5); (5) A nonprofit organization; (6) An institution of higher education; (7) Protected health information under HIPAA; (8) Health records for purposes of title 68; (9) Patient identifying information for purposes of 42 U.S.C. § 290dd-2; (10) Personal information: (A) Processed for purposes of: (i) Research conducted in accordance with the federal policy for the protection of huma… Archived from source — captured 2026-08-03 · snapshot 2bba6177 Tenn. Code Ann. § 47-18-3311 — Enacted as Pub. Ch. 408 § 47-18-3210. Verify at the source
Patient identifying information under 42 U.S.C. § 290dd-2 Archived excerpt — the text we read …ogy for Economic and Clinical Health Act (P.L. 111-5); (5) A nonprofit organization; (6) An institution of higher education; (7) Protected health information under HIPAA; (8) Health records for purposes of title 68; (9) Patient identifying information for purposes of 42 U.S.C. § 290dd-2; (10) Personal information: (A) Processed for purposes of: (i) Research conducted in accordance with the federal policy for the protection of human subjects under 45 CFR Part 46; (ii) Human subjects research conducted i… Archived from source — captured 2026-08-03 · snapshot 2bba6177 Tenn. Code Ann. § 47-18-3311 — Enacted as Pub. Ch. 408 § 47-18-3210. Verify at the source
Human subjects research data Archived excerpt — the text we read …ion of higher education; (7) Protected health information under HIPAA; (8) Health records for purposes of title 68; (9) Patient identifying information for purposes of 42 U.S.C. § 290dd-2; (10) Personal information: (A) Processed for purposes of: (i) Research conducted in accordance with the federal policy for the protection of human subjects under 45 CFR Part 46; (ii) Human subjects research conducted in accordance with good clinical practice guidelines issued by The International Council for Harmonization of Technical Requirements for Pharmaceuticals for Human Use; or (iii) Research conducted in accordance with the protection of human subjects under 21 CFR Parts 6, 50, and 56; or (B) Processed or sold in connection with research conducted in accordance with the requirements set forth in this part, or other research conducted in accordance with applicable law; (11) Information and documents created for purposes of the federal Health Care Quality Improvement Act of 1986 (42 U.S.C. § 11101 et seq.); (12) Patient safety work product for purposes of the federal Patient Safety an… Archived from source — captured 2026-08-03 · snapshot 2bba6177 Tenn. Code Ann. § 47-18-3311 — Enacted as Pub. Ch. 408 § 47-18-3210. Verify at the source
Health Care Quality Improvement Act information Archived excerpt — the text we read … 21 CFR Parts 6, 50, and 56; or (B) Processed or sold in connection with research conducted in accordance with the requirements set forth in this part, or other research conducted in accordance with applicable law; (11) Information and documents created for purposes of the federal Health Care Quality Improvement Act of 1986 (42 U.S.C. § 11101 et seq.); (12) Patient safety work product for purposes of the federal Patient Safety and Quality Improvement Act (42 U.S.C. § 299b-21 et seq.); (13) Information that is: (A) Derived from the healthcare-related inf… Archived from source — captured 2026-08-03 · snapshot 2bba6177 Tenn. Code Ann. § 47-18-3311 — Enacted as Pub. Ch. 408 § 47-18-3210. Verify at the source
Patient safety work product Archived excerpt — the text we read … this part, or other research conducted in accordance with applicable law; (11) Information and documents created for purposes of the federal Health Care Quality Improvement Act of 1986 (42 U.S.C. § 11101 et seq.); (12) Patient safety work product for purposes of the federal Patient Safety and Quality Improvement Act (42 U.S.C. § 299b-21 et seq.); (13) Information that is: (A) Derived from the healthcare-related information listed in this subsection (a) that is de-identified in accordance with the requirements for de-identification pursuant to HIPA… Archived from source — captured 2026-08-03 · snapshot 2bba6177 Tenn. Code Ann. § 47-18-3311 — Enacted as Pub. Ch. 408 § 47-18-3210. Verify at the source
HIPAA de-identified data Archived excerpt — the text we read …Act of 1986 (42 U.S.C. § 11101 et seq.); (12) Patient safety work product for purposes of the federal Patient Safety and Quality Improvement Act (42 U.S.C. § 299b-21 et seq.); (13) Information that is: (A) Derived from the healthcare-related information listed in this subsection (a) that is de-identified in accordance with the requirements for de-identification pursuant to HIPAA; or (8) Included in a limited data set as described in 45 CFR 164.514(e), to the extent that the information is used, disclosed, and maintained in the manner specified in 45 CFR 164.514(e); (14) Information originating … Archived from source — captured 2026-08-03 · snapshot 2bba6177 Tenn. Code Ann. § 47-18-3311 — Enacted as Pub. Ch. 408 § 47-18-3210. Verify at the source
HIPAA limited data set Archived excerpt — the text we read …ormation that is: (A) Derived from the healthcare-related information listed in this subsection (a) that is de-identified in accordance with the requirements for de-identification pursuant to HIPAA; or (8) Included in a limited data set as described in 45 CFR 164.514(e), to the extent that the information is used, disclosed, and maintained in the manner specified in 45 CFR 164.514(e); (14) Information originating from, and intermingled to be indistinguishable with, or information treated in the same manner as, information exempt under this subsection (a) that is maintained by a covered entity or bus… Archived from source — captured 2026-08-03 · snapshot 2bba6177 Tenn. Code Ann. § 47-18-3311 — Enacted as Pub. Ch. 408 § 47-18-3210. Verify at the source
Information intermingled with HIPAA-exempt data When maintained by a HIPAA covered entity/business associate or a 42 U.S.C. § 290dd-2 program/qualified service organization. Archived excerpt — the text we read …cation pursuant to HIPAA; or (8) Included in a limited data set as described in 45 CFR 164.514(e), to the extent that the information is used, disclosed, and maintained in the manner specified in 45 CFR 164.514(e); (14) Information originating from, and intermingled to be indistinguishable with, or information treated in the same manner as, information exempt under this subsection (a) that is maintained by a covered entity or business associate as defined by HIPAA or a program or a qualified service organization as defined by 42 U.S.C. § 290dd-2; (15) Information used only for public health activities and purposes as authorized by HIPAA; (16) The collection, maintenance, disclosure, sale, communication, or use of personal information bearing on a consumer's cre… Archived from source — captured 2026-08-03 · snapshot 2bba6177 Tenn. Code Ann. § 47-18-3311 — Enacted as Pub. Ch. 408 § 47-18-3210. Verify at the source
HIPAA public health activities information Archived excerpt — the text we read … as, information exempt under this subsection (a) that is maintained by a covered entity or business associate as defined by HIPAA or a program or a qualified service organization as defined by 42 U.S.C. § 290dd-2; (15) Information used only for public health activities and purposes as authorized by HIPAA; (16) The collection, maintenance, disclosure, sale, communication, or use of personal information bearing on a consumer's credit worthiness, credit standing, credit capacity, character, general reputation, personal cha… Archived from source — captured 2026-08-03 · snapshot 2bba6177 Tenn. Code Ann. § 47-18-3311 — Enacted as Pub. Ch. 408 § 47-18-3210. Verify at the source
FCRA-regulated data Archived excerpt — the text we read …usiness associate as defined by HIPAA or a program or a qualified service organization as defined by 42 U.S.C. § 290dd-2; (15) Information used only for public health activities and purposes as authorized by HIPAA; (16) The collection, maintenance, disclosure, sale, communication, or use of personal information bearing on a consumer's credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living by a consumer reporting agency or furnisher that provides information for use in a consumer report, and by a user of a consumer report, but only to the extent that such activity is regulated by and authorized under the federal Fair Credit Reporting Act (15 U.S.C. § 1681 et seq.); (17) Personal information collected, processed, sold, or disclosed in compliance with the federal Driver's Privacy Protection Act of 1994 (18 U.S.C. § 2721 et seq.); (18) Personal information or educational information… Archived from source — captured 2026-08-03 · snapshot 2bba6177 Tenn. Code Ann. § 47-18-3311 — Enacted as Pub. Ch. 408 § 47-18-3210. Verify at the source
Driver's Privacy Protection Act data Archived excerpt — the text we read …ion for use in a consumer report, and by a user of a consumer report, but only to the extent that such activity is regulated by and authorized under the federal Fair Credit Reporting Act (15 U.S.C. § 1681 et seq.); (17) Personal information collected, processed, sold, or disclosed in compliance with the federal Driver's Privacy Protection Act of 1994 (18 U.S.C. § 2721 et seq.); (18) Personal information or educational information regulated by the federal Family Educational Rights and Privacy Act (FERPA) (20 U.S.C. § 1232g et seq.); (19) Personal information collected, processed, sold, or disc… Archived from source — captured 2026-08-03 · snapshot 2bba6177 Tenn. Code Ann. § 47-18-3311 — Enacted as Pub. Ch. 408 § 47-18-3210. Verify at the source
FERPA-regulated educational information Archived excerpt — the text we read …Credit Reporting Act (15 U.S.C. § 1681 et seq.); (17) Personal information collected, processed, sold, or disclosed in compliance with the federal Driver's Privacy Protection Act of 1994 (18 U.S.C. § 2721 et seq.); (18) Personal information or educational information regulated by the federal Family Educational Rights and Privacy Act (FERPA) (20 U.S.C. § 1232g et seq.); (19) Personal information collected, processed, sold, or disclosed in compliance with the federal Farm Credit Act (12 U.S.C. § 2001 et seq.); (20) Data processed or maintained: (A) In the course of an individual applyi… Archived from source — captured 2026-08-03 · snapshot 2bba6177 Tenn. Code Ann. § 47-18-3311 — Enacted as Pub. Ch. 408 § 47-18-3210. Verify at the source
Farm Credit Act data Archived excerpt — the text we read …rivacy Protection Act of 1994 (18 U.S.C. § 2721 et seq.); (18) Personal information or educational information regulated by the federal Family Educational Rights and Privacy Act (FERPA) (20 U.S.C. § 1232g et seq.); (19) Personal information collected, processed, sold, or disclosed in compliance with the federal Farm Credit Act (12 U.S.C. § 2001 et seq.); (20) Data processed or maintained: (A) In the course of an individual applying to, being employed by, or acting as an agent or independent contractor of a controller, processor, or third party, to the extent that the d… Archived from source — captured 2026-08-03 · snapshot 2bba6177 Tenn. Code Ann. § 47-18-3311 — Enacted as Pub. Ch. 408 § 47-18-3210. Verify at the source
Employment data Archived excerpt — the text we read …t (FERPA) (20 U.S.C. § 1232g et seq.); (19) Personal information collected, processed, sold, or disclosed in compliance with the federal Farm Credit Act (12 U.S.C. § 2001 et seq.); (20) Data processed or maintained: (A) In the course of an individual applying to, being employed by, or acting as an agent or independent contractor of a controller, processor, or third party, to the extent that the data is collected and used within the context of that role; (8) As the emergency contact information of an individual under this part used for emergency contact purposes; or (C) That is necessary to retain to administer benefits for another individual relating to the individual… Archived from source — captured 2026-08-03 · snapshot 2bba6177 Tenn. Code Ann. § 47-18-3311 — Enacted as Pub. Ch. 408 § 47-18-3210. Verify at the source
Emergency contact information Archived excerpt — the text we read …dividual applying to, being employed by, or acting as an agent or independent contractor of a controller, processor, or third party, to the extent that the data is collected and used within the context of that role; (8) As the emergency contact information of an individual under this part used for emergency contact purposes; or (C) That is necessary to retain to administer benefits for another individual relating to the individual under subdivision (a)(20)(A) and used for the purposes of administering those benefits; (21) Information colle… Archived from source — captured 2026-08-03 · snapshot 2bba6177 Tenn. Code Ann. § 47-18-3311 — Enacted as Pub. Ch. 408 § 47-18-3210. Verify at the source
Benefits administration data Archived excerpt — the text we read …r, or third party, to the extent that the data is collected and used within the context of that role; (8) As the emergency contact information of an individual under this part used for emergency contact purposes; or (C) That is necessary to retain to administer benefits for another individual relating to the individual under subdivision (a)(20)(A) and used for the purposes of administering those benefits; (21) Information collected as part of public- or peer-reviewed scientific or statistical research in the public interest; (22) An insurance producer licensed under title 56; or (23) Personal information maintained or u… Archived from source — captured 2026-08-03 · snapshot 2bba6177 Tenn. Code Ann. § 47-18-3311 — Enacted as Pub. Ch. 408 § 47-18-3210. Verify at the source
Public or peer-reviewed scientific research information Archived excerpt — the text we read … contact purposes; or (C) That is necessary to retain to administer benefits for another individual relating to the individual under subdivision (a)(20)(A) and used for the purposes of administering those benefits; (21) Information collected as part of public- or peer-reviewed scientific or statistical research in the public interest; (22) An insurance producer licensed under title 56; or (23) Personal information maintained or used for purposes of compliance with the regulation of listed chemicals under the federal Controlled Substances Act (21 U.S… Archived from source — captured 2026-08-03 · snapshot 2bba6177 Tenn. Code Ann. § 47-18-3311 — Enacted as Pub. Ch. 408 § 47-18-3210. Verify at the source
Licensed insurance producers Archived excerpt — the text we read …dual under subdivision (a)(20)(A) and used for the purposes of administering those benefits; (21) Information collected as part of public- or peer-reviewed scientific or statistical research in the public interest; (22) An insurance producer licensed under title 56; or (23) Personal information maintained or used for purposes of compliance with the regulation of listed chemicals under the federal Controlled Substances Act (21 U.S.C. § 830). (b) Controllers and processors that comp… Archived from source — captured 2026-08-03 · snapshot 2bba6177 Tenn. Code Ann. § 47-18-3311 — Enacted as Pub. Ch. 408 § 47-18-3210. Verify at the source
Controlled Substances Act compliance data Archived excerpt — the text we read …oses of administering those benefits; (21) Information collected as part of public- or peer-reviewed scientific or statistical research in the public interest; (22) An insurance producer licensed under title 56; or (23) Personal information maintained or used for purposes of compliance with the regulation of listed chemicals under the federal Controlled Substances Act (21 U.S.C. § 830). (b) Controllers and processors that comply with the verifiable parental consent requirements of the federal Children's Online Privacy Protection Act (15 U.S.C. § 6501 et seq.) are deemed compliant with an obligation to… Archived from source — captured 2026-08-03 · snapshot 2bba6177 Tenn. Code Ann. § 47-18-3311 — Enacted as Pub. Ch. 408 § 47-18-3210. Verify at the source
Trade secrets Archived excerpt — the text we read …able parental consent requirements of the federal Children's Online Privacy Protection Act (15 U.S.C. § 6501 et seq.) are deemed compliant with an obligation to obtain parental consent under this part. (c) This part does not require a controller, processor, third party, or consumer to disclose trade secrets. Archived from source — captured 2026-08-03 · snapshot 2bba6177 Tenn. Code Ann. § 47-18-3311 — Enacted as Pub. Ch. 408 § 47-18-3210. Verify at the source
Purely personal activity Archived excerpt — the text we read …se an obligation on controllers and processors that adversely affects the rights or freedoms of a person, such as exercising the right of free speech pursuant to the First Amendment to the United States Constitution, or applies to the processing of personal information by a person in the course of a purely personal activity. (f) A controller shall not process personal information for purposes other than those expressly listed in this section unless otherwise allowed by this part. Personal information processed by a controller pursuant to t… Archived from source — captured 2026-08-03 · snapshot 2bba6177 Tenn. Code Ann. § 47-18-3309 — Enacted as Pub. Ch. 408 § 47-18-3208. Verify at the source
Evidentiary privilege (compliance would violate a Tennessee evidentiary privilege) Archived excerpt — the text we read …roller or are otherwise compatible with processing data in furtherance of the provision of a product or service specifically requested by a consumer or the performance of a contract to which the consumer is a party. (c) The obligations imposed on controllers or processors under this part do not apply where compliance by the controller or processor with this part would violate an evidentiary privilege under the laws of this state. This part does not prevent a controller or processor from providing personal information concerning a consumer to a person covered by an evidentiary privilege under the laws of this state as part of a privileged commun… Archived from source — captured 2026-08-03 · snapshot 2bba6177 Tenn. Code Ann. § 47-18-3309 — Enacted as Pub. Ch. 408 § 47-18-3208. Verify at the source
Privileged communications to a person covered by an evidentiary privilege Archived excerpt — the text we read …. (c) The obligations imposed on controllers or processors under this part do not apply where compliance by the controller or processor with this part would violate an evidentiary privilege under the laws of this state. This part does not prevent a controller or processor from providing personal information concerning a consumer to a person covered by an evidentiary privilege under the laws of this state as part of a privileged communication. (d) (1) A controller or processor that discloses personal information to a thirdparty controller or processor, in compliance with the requirements of this part, is not in violation of this part if: (A) The third-party … Archived from source — captured 2026-08-03 · snapshot 2bba6177 Tenn. Code Ann. § 47-18-3309 — Enacted as Pub. Ch. 408 § 47-18-3208. Verify at the source
Rights and freedoms of others, including free speech Archived excerpt — the text we read … controller or processor in compliance with the requirements of this part is likewise not in violation of this part for the violations of the controller or processor from which it receives such personal information. (e) This part does not impose an obligation on controllers and processors that adversely affects the rights or freedoms of a person, such as exercising the right of free speech pursuant to the First Amendment to the United States Constitution, or applies to the processing of personal information by a person in the course of a purely personal activity. (f) A controller shall not process personal information for purposes other than those expressly listed in th… Archived from source — captured 2026-08-03 · snapshot 2bba6177 Tenn. Code Ann. § 47-18-3309 — Enacted as Pub. Ch. 408 § 47-18-3208. Verify at the source

Published Sep 29, 2026 from the DataGrail regulation engine; each fact links to its primary source.

Timeline

TIPA milestones

This state currently has one dated milestone on the books.

Enforcement July 1, 2025

TIPA took effect

Enforcement began — obligations have been live since this date.

Source: primary citation

Published Sep 29, 2026 from the DataGrail regulation engine; each fact links to its primary source. Reference only, not legal advice.

Status Signed Status — Privacy-law tracker Effective — Regulator guidance Private right of action — Privacy-law tracker

When staying on top of the law isn't enough, DataGrail automates the work.

DSR automation and regulatory tracking — handled by the platform behind this reference.

How DataGrail helps

Back to the Regulations Hub Reference only — not legal advice. Published Sep 29, 2026