Governance, risk & compliance

Tennessee Information Protection Act (TIPA) T.C.A. 47-18-3201 to 3213 (Pub. Ch. 408)

The Tennessee Information Protection Act (Tenn.

Code Ann. 47-18-3201 to 47-18-3213, Public Chapter 408 of 2023), effective 1 July 2025.

It applies to a business that does business in Tennessee or targets its residents with annual revenue over $25,000,000 and, in a calendar year, either 175,000 consumers or 25,000 consumers while earning more than 50% of gross revenue from sale. Insurers licensed under title 56, nonprofits, higher education, GLBA financial institutions and HIPAA covered entities are exempt.

Consumers can confirm and access, correct, delete, get a portable copy, and opt out of targeted advertising, sale and profiling, with a 45-day response and a 60-day appeal. Controllers need consent for sensitive data, processor contracts, and data protection assessments for activities from 1 July 2024.

A written privacy program that reasonably conforms to the NIST Privacy Framework is an affirmative defence (47-18-3213). The Attorney General and Reporter alone enforces after a 60-day cure with no end date; penalties reach $7,500 per violation, with treble damages for wilful or knowing violations; there is no private right.

Not verified: (1) Amendments to the Act after Public Chapter 408 of 2023 were not checked. (2) The sensitive data definition and the free-response rule were not itemized; the penalty was read from the enrolled chapter and should be confirmed in the Code.

(3) The scope of the NIST affirmative defence in 47-18-3213 is summarized, not quoted; counsel should read it before relying on it. General information for compliance work, not legal advice.

Assessment tiers & levels Lavawall supports

Lavawall assesses Tennessee Information Protection Act (TIPA) at every level below, so you can start where you are and step up as your program matures.

How Lavawall® helps you get to Tennessee Information Protection Act (TIPA) compliance

Most of Tennessee Information Protection Act (TIPA) comes down to technical controls you have to run and prove: keeping systems patched, hardening configuration, detecting breaches early, backing up what matters, controlling access, and keeping evidence that all of it actually happened. Lavawall® runs those controls across Windows, macOS, Linux, and Microsoft 365 / Google Workspace from one console, maps them to Tennessee Information Protection Act (TIPA), and tracks your posture continuously instead of once a year at audit time.

• Assess your current state against Tennessee Information Protection Act (TIPA) in the Lavawall GRC module, with the questionnaire and control set built in.
• Remediate the gaps with the same platform — automated patching, configuration fixes, backups, and access review — not a separate project.
• Evidence everything with timestamped, exportable records auditors, insurers, and clients accept.

Related

Lavawall® supports Tennessee Information Protection Act (TIPA) as part of a built-in catalogue of compliance frameworks. Framework requirements are summarized for planning purposes; always confirm the current official text before certifying.