Compliance Reminder — June 23, 2025
Final reminder to complete Tennessee Information Protection Act readiness ahead of the July 1, 2025 start date, focusing on notices, DSAR/appeals, minimization, processor contracts, and global opt-out handling.
Reminder: Tennessee’s Information Protection Act (TIPA) enters enforcement on 1 July 2025. Controllers meeting the 175,000-consumer threshold—or 25,000 with over 25% of gross revenue from selling personal data—must finalize privacy notices, DSAR operations, and processor governance ahead of the go-live.
What must be locked by July 1:
- Publish refreshed privacy notices detailing processing purposes, categories sold or used for targeted ads, and clear instructions for submitting and appealing consumer requests.
- Verify DSAR tooling can honor access, correction, deletion, portability, and opt-out rights within the 45-day response timeline and supports a 60-day appeal decision window.
- Document data minimization and purpose-compatibility for high-volume or sensitive processing and complete assessments for targeted advertising, sales, profiling risks, and sensitive data uses.
- Update processor/subprocessor contracts to align with TIPA and Virginia/Colorado baselines, including instructions, confidentiality, subprocessor vetting, assistance, and secure deletion/return requirements.
- Activate acceptance of global privacy controls to streamline opt-out flows across Tennessee, Virginia, and Colorado even though TIPA does not expressly require universal signals.
Escalations: Maintain an appeal decision log, publish Attorney General contact details in denial responses, and rehearse the 60-day appeal window to avoid noncompliance claims once the 60-day cure period sunsets after 31 December 2025.
Continue in the Compliance pillar
Return to the hub for curated research and deep-dive guides.
Latest guides
-
Third-Party Risk Oversight Playbook — Zeph Tech
Operationalize OCC, Federal Reserve, EBA, and MAS outsourcing expectations with lifecycle controls, continuous monitoring, and board reporting.
-
Compliance Operations Control Room — Zeph Tech
Implement cross-border compliance operations that satisfy Sarbanes-Oxley, DOJ guidance, EU DORA, and MAS TRM requirements with verifiable evidence flows.
-
SOX Modernization Control Playbook — Zeph Tech
Modernize Sarbanes-Oxley (SOX) compliance by aligning PCAOB AS 2201, SEC management guidance, and COSO 2013 controls with data-driven testing, automation, and board reporting.