Tennessee Information Protection Act
Tennessee privacy law (TIPA): enforcement
Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026
Summary (not the statute text)
The Attorney General and Reporter enforces the Act exclusively after a permanent 60-day notice and cure period. Courts may impose civil penalties of up to $7,500 per violation and may treble the award for wilful or knowing violations. A business has an affirmative defence if it keeps and follows a written privacy program that reasonably conforms to the NIST Privacy Framework or comparable documented standards.
Key points
Exclusive enforcement by the Attorney General and Reporter.
Section: Tenn. Code Ann. § 47-18-3313(a)
60 days' written notice and a chance to cure, with an express written statement, before any action; no sunset.
Section: Tenn. Code Ann. § 47-18-3313(b)
Civil penalty of up to $7,500 for each violation; treble damages at the court's discretion for wilful or knowing violations.
Section: Tenn. Code Ann. § 47-18-3313(d)
Affirmative defence: a written privacy program that reasonably conforms to the NIST Privacy Framework (Version 1.0) or other documented privacy standards, updated within two years of each new revision, and that gives the rights the Act requires.
Section: Tenn. Code Ann. § 47-18-3314(a)
The program's scale is judged by size, activities, data sensitivity, cost of tools and compliance with comparable laws; APEC CBPR or PRP certification may also be considered.
Section: Tenn. Code Ann. § 47-18-3314(b)-(c)
No private right of action, including class actions.
Section: Tenn. Code Ann. § 47-18-3313(e)
Sources
Compare enforcement across all states
Related GDPR articles
Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.
Law as of October 28, 2026.
Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.
Official text of the Tennessee statute
Reference material, not legal advice.