What is the Tennessee Information Protection Act (TIPA)? | UpGuard

Overview of the Tennessee Information Protection Act (TIPA), effective July 1, 2025, which establishes state-level data privacy requirements for controllers meeting revenue (over $25M) and processing thresholds (either ≥25,000 consumers and >50% revenue from selling data or ≥175,000 consumers). It summarizes consumer rights (confirmation, access, correction, deletion, portability, opt-out), controller and processor obligations (limited collection, administrative/technical/physical security controls, consent for sensitive data, privacy notices, data protection assessments), enumerates exemptions, and describes enforcement by the Tennessee Attorney General with civil penalties up to $7,500 per violation and an affirmative defense for organizations following the NIST privacy framework.