Tennessee's privacy law and your small business

Who the law covers

According to the Tennessee Attorney General, the Tennessee Information Protection Act applies to businesses that do business in Tennessee or target its residents and earn more than $25 million in annual revenue, and that also either process the personal information of at least 175,000 Tennessee consumers in a year, or process at least 25,000 consumers' information while getting more than half their revenue from selling it.

Both parts must be true. A local business under the revenue line is outside the law, whatever tools it uses.

Why it still matters if you are outside it

Your larger customers and partners may be covered, and they will ask you how you handle the data they share. Having a clear answer, which tools see which information and who can switch them off, wins work and saves awkward questions.

The habits the law encourages are good practice anyway: know what personal information you collect, do not keep it longer than you need, and do not put it into tools whose terms you have not read.

Who enforces it

According to the Attorney General's guidance, the Attorney General has exclusive authority to bring actions under the law, and a court can impose civil penalties of up to $7,500 per violation.

What this page is not

This is an orientation drawn from the Attorney General's public guidance, not legal advice. If your business is near the thresholds, or handles health, financial, or children's information, ask a Tennessee lawyer.