USA – TENNESSEE Trends and Developments Contributed by: Alisa Chestler, Matthew White and Andrew Droke, Baker, Donelson, Bearman, Caldwell & Berkowitz, PC
Baker, Donelson, Bearman, Caldwell & Berkowitz, PC 1600 West End Avenue Suite 2000 Nashville, TN 37203 USA
Tel: +1 615 726 5600 Fax: +1 615 726 0464 Web: www.bakerdonelson.com
Tennessee’s reputation as a business-friendly state is well earned; however, when it comes to data pro - tection, the regulatory landscape has evolved rapidly. Over the last few years, the state has enacted several new laws governing how businesses collect, use and safeguard personal data, as well as how they deploy emerging technologies such as artificial intelligence (AI). From the Tennessee Information Protection Act to first-of-its-kind AI legislation, these laws carry real operational implications across industries, and the consequences of non-compliance are significant. This guide provides a practical overview of the key Tennes - see requirements with respect to privacy, data secu - rity and technology, equipping businesses with the foundation they need to navigate this shifting terrain. Privacy Tennessee has adopted a comprehensive consum - er privacy law as well as industry-specific privacy requirements, creating a state-specific patchwork of obligations. Businesses in Tennessee must under - stand both the generally applicable laws as well as those that apply specifically to their industry. The Tennessee Information Protection Act Like many other states, Tennessee has adopted a comprehensive consumer privacy law. The Tennes - see Information Protection Act (TIPA) went into effect on 1 July 2025, and certain aspects are similar to comprehensive privacy laws enacted in other states. However, as discussed in more detail below, many of TIPA’s requirements are unique, and businesses should carefully assess compliance.
Applicability TIPA applies to persons who meet the following cri - teria: • either conduct business in Tennessee or produce products or services that are targeted to residents of Tennessee; and • have more than USD25 million in annual revenue; and • either control or process the personal information of at least 175,000 Tennessee consumers during a calendar year, or control or process the personal information of at least 25,000 Tennessee consum - ers and derive 50% of their gross annual revenue from the sale of that information. Although these thresholds mean that many small businesses in Tennessee will not be subject to the law, it is important for businesses to regularly monitor both their revenue and their data-related activities to assess whether the law applies. In addition to tailoring its scope via the thresholds discussed above, TIPA also limits its applicability with several exceptions. By way of example, TIPA does not apply to:
• governmental agencies; • non-profit organisations;
• covered entities and business associates subject to the Health Insurance Portability and Account - ability Act of 1996 (HIPAA); • higher educational institutions (public or private); • insurance companies licensed under state law; and
608 CHAMBERS.COM
Powered by FlippingBook