DPO SchoolDPO School

Tennessee Information Protection Act

Tennessee privacy law (TIPA): controller duties

Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026

Summary (not the statute text)

Controllers must limit collection to what is adequate, relevant and reasonably necessary, keep reasonable security, and publish a privacy notice. Tennessee does not require controllers to honour universal opt-out signals. Data protection assessments are required for targeted advertising, sale, risky profiling, sensitive data and other high-risk processing.

Key points

  1. Data minimisation: collection limited to what is adequate, relevant and reasonably necessary for the disclosed purposes.

    Section: Tenn. Code Ann. § 47-18-3305(a)(1)

  2. No processing beyond what is reasonably necessary and compatible with the disclosed purposes without consent.

    Section: Tenn. Code Ann. § 47-18-3305(a)(2)

  3. Privacy notice must list categories of data, purposes, how to exercise and appeal rights, and the categories of data sold and of third parties to whom data is sold.

    Section: Tenn. Code Ann. § 47-18-3305(c)

  4. Sales and targeted advertising must be disclosed clearly with the way to opt out.

    Section: Tenn. Code Ann. § 47-18-3305(d)

  5. No universal opt-out signal duty appears in the Act.

    Section: Tenn. Code Ann. § 47-18-3305

  6. Assessments are required for targeted advertising, sale, risky profiling, sensitive data and heightened-risk processing, for activities created on or after 1 Jul 2024.

    Section: Tenn. Code Ann. § 47-18-3307(a), (f)

Sources

Compare controller duties across all states

Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

Law as of October 28, 2026.

Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.

Official text of the Tennessee statute

Reference material, not legal advice.