---
title: "Tennessee privacy law (TIPA): applicability"
canonical: "https://dposchool.com/state-privacy-laws/state/tennessee/applicability"
source: "https://publications.tnsosfiles.com/acts/113/pub/pc0408.pdf"
text_as_of: "2026-10-28"
last_reviewed: "2026-10-29"
language: "en-US"
publisher: "DPO School"
---

Tennessee Information Protection Act

# Tennessee privacy law (TIPA): applicability

Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review)

## Summary (not the statute text)

The Act applies only to persons doing business in Tennessee or targeting its residents that have more than $25 million in revenue and that either handle personal information of at least 175,000 consumers in a calendar year, or handle data of at least 25,000 consumers and earn more than 50% of gross revenue from selling it. Financial institutions, licensed insurers and insurance producers, HIPAA covered entities and business associates, nonprofits and higher education institutions are exempt as entities.

## Key points

1. Revenue test: more than $25 million in revenue, required in every case.

   Section: [Tenn. Code Ann. § 47-18-3303(1)](https://publications.tnsosfiles.com/acts/113/pub/pc0408.pdf)

2. Plus either 175,000 consumers in a calendar year, or 25,000 consumers and more than 50% of gross revenue from sales.

   Section: [Tenn. Code Ann. § 47-18-3303(2)](https://publications.tnsosfiles.com/acts/113/pub/pc0408.pdf)

3. GLBA: financial institutions, their affiliates and data subject to GLBA Title V are exempt.

   Section: [Tenn. Code Ann. § 47-18-3311(a)(2)](https://publications.tnsosfiles.com/acts/113/pub/pc0408.pdf)

4. Licensed insurance companies and insurance producers are exempt.

   Section: [Tenn. Code Ann. § 47-18-3311(a)(3), (a)(22)](https://publications.tnsosfiles.com/acts/113/pub/pc0408.pdf)

5. HIPAA covered entities and business associates are exempt as entities; protected health information is also exempt.

   Section: [Tenn. Code Ann. § 47-18-3311(a)(4), (a)(7)](https://publications.tnsosfiles.com/acts/113/pub/pc0408.pdf)

6. Nonprofits (broadly defined) and higher education institutions are exempt.

   Section: [Tenn. Code Ann. § 47-18-3311(a)(5)-(6)](https://publications.tnsosfiles.com/acts/113/pub/pc0408.pdf)

7. Employee, applicant and contractor data used in that role is exempt.

   Section: [Tenn. Code Ann. § 47-18-3311(a)(20)](https://publications.tnsosfiles.com/acts/113/pub/pc0408.pdf)

## Sources

- [Public Chapter 408 (2023), enrolled HB 1181, Tennessee Information Protection Act](https://publications.tnsosfiles.com/acts/113/pub/pc0408.pdf)

[Compare applicability across all states](https://dposchool.com/state-privacy-laws/topic/applicability)

## Status

Law as of October 28, 2026.

[Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed.

[Official text of the Tennessee statute](https://publications.tnsosfiles.com/acts/113/pub/pc0408.pdf)

Reference material, not legal advice.

## Other topics for Tennessee

- [Consumer rights](https://dposchool.com/state-privacy-laws/state/tennessee/consumer-rights)
- [Sensitive data](https://dposchool.com/state-privacy-laws/state/tennessee/sensitive-data)
- [Controller duties](https://dposchool.com/state-privacy-laws/state/tennessee/controller-duties)
- [Processors](https://dposchool.com/state-privacy-laws/state/tennessee/processors)
- [Enforcement](https://dposchool.com/state-privacy-laws/state/tennessee/enforcement)

## Navigation

[US State Privacy Laws](https://dposchool.com/state-privacy-laws) / [Tennessee](https://dposchool.com/state-privacy-laws/state/tennessee) / Applicability

Next: [Consumer rights](https://dposchool.com/state-privacy-laws/state/tennessee/consumer-rights)

Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com).

## For AI agents

- Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt
- JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents