Tennessee Information Protection Act
Tennessee privacy law (TIPA): processors
Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026
Summary (not the statute text)
Processors must follow the controller's instructions and help with consumer requests and assessments. A binding contract must set out instructions, nature, purpose, data types, duration and the parties' rights and duties, and must require confidentiality, deletion or return, proof of compliance, cooperation with assessments (or an independent assessment) and subcontractor flow-down.
Key points
Processors must follow instructions and assist with consumer requests and assessments.
Section: Tenn. Code Ann. § 47-18-3306(a)
Contract must set out instructions, nature and purpose, data types, duration, and the rights and obligations of both parties.
Section: Tenn. Code Ann. § 47-18-3306(b)
Required terms: confidentiality, deletion or return, information to show compliance, assessments by the controller or an independent assessor, and written subcontracts.
Whether a person is a controller or processor is a fact-based question.
Section: Tenn. Code Ann. § 47-18-3306(d)
Sources
Compare processors across all states
Related GDPR articles
Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.
- Article 28: Processor (processors)
Law as of October 28, 2026.
Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.
Official text of the Tennessee statute
Reference material, not legal advice.