Tennessee Information Protection Act
Tennessee privacy law (TIPA): applicability
Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026
Summary (not the statute text)
The Act applies only to persons doing business in Tennessee or targeting its residents that have more than $25 million in revenue and that either handle personal information of at least 175,000 consumers in a calendar year, or handle data of at least 25,000 consumers and earn more than 50% of gross revenue from selling it. Financial institutions, licensed insurers and insurance producers, HIPAA covered entities and business associates, nonprofits and higher education institutions are exempt as entities.
Key points
Revenue test: more than $25 million in revenue, required in every case.
Section: Tenn. Code Ann. § 47-18-3303(1)
Plus either 175,000 consumers in a calendar year, or 25,000 consumers and more than 50% of gross revenue from sales.
Section: Tenn. Code Ann. § 47-18-3303(2)
GLBA: financial institutions, their affiliates and data subject to GLBA Title V are exempt.
Section: Tenn. Code Ann. § 47-18-3311(a)(2)
Licensed insurance companies and insurance producers are exempt.
HIPAA covered entities and business associates are exempt as entities; protected health information is also exempt.
Nonprofits (broadly defined) and higher education institutions are exempt.
Employee, applicant and contractor data used in that role is exempt.
Section: Tenn. Code Ann. § 47-18-3311(a)(20)
Sources
Compare applicability across all states
Law as of October 28, 2026.
Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.
Official text of the Tennessee statute
Reference material, not legal advice.