Tennessee TIPA

Tennessee Information Protection Act - controller duties, NIST Privacy Framework alignment.


Short name	TN TIPA
Region	Americas
Country or scope	United States
Sector	Privacy
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers TN TIPA

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 8 controls from Safeguard's control catalog for TN TIPA.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 24: 2 written for TN TIPA and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`TN-TIPA-SEC` Data Security Practices	Controllers must establish, implement and maintain reasonable administrative, technical and physical data security practices appropriate to the volume and nature of personal information; integrity-verifiable processing software evidences those practices (Tenn. Code Ann. § 47-18-3201 et seq., controller-duties provision)	Scan
`TN-TIPA-NIST` NIST Privacy Framework Program Evidence	TIPA's affirmative defense rewards a documented, repeatable privacy program reasonably conforming to the NIST Privacy Framework; machine-readable, standardised documentation of processing systems (SPDX/CycloneDX) is characteristic of such a program (Tenn. Code Ann. § 47-18-3201 et seq., NIST-conformance affirmative defense)	Scan
`TN-TIPA-INV` Processing Inventory	Both the minimisation duty and NIST Privacy Framework's Identify function require knowing what systems and software process personal information; an enumerated component inventory is the baseline artifact (Tenn. Code Ann. § 47-18-3201 et seq., read with NIST PF Identify-P)	Scan
`TN-TIPA-PROC` Processor Obligations	Processing on a controller's behalf must be governed by binding contracts with flow-down to subcontractors; the supplier behind each third-party component should be named to demonstrate oversight (Tenn. Code Ann. § 47-18-3201 et seq., processor provisions)	Scan
`TN-TIPA-DPIA` Data Protection Assessment Readiness	Data protection assessments are required for targeted advertising, sale, risky profiling and sensitive data; assessing risk requires the versions of the software involved to be recorded (Tenn. Code Ann. § 47-18-3201 et seq., data protection assessment provisions)	Scan
`TN-TIPA-RIGHTS` Consumer Rights Fulfilment	Consumers may confirm processing, access, correct, delete and port personal information and opt out of targeted advertising, sale and profiling; fulfilling requests requires unambiguous identification of the components holding the data (Tenn. Code Ann. § 47-18-3201 et seq., consumer-rights provisions)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`TCA-47-18-3202`	Consumer Rights: Access, Correction, Deletion & Portability
`TCA-47-18-3203`	Opt-Out of Sale, Targeted Advertising & Profiling
`TCA-47-18-3204`	Sensitive Data: Opt-In Consent
`TCA-47-18-3206`	Data Protection Assessment
`TCA-47-18-3207`	Processor Contracts
`TCA-47-18-3201`	Privacy Notice
`TCA-47-18-3205`	Controller Security & Minimization Duties
`TCA-47-18-3208`	Consumer Appeals

Policy templates

Written for TN TIPA:

Tennessee TIPA State Privacy Notice
Tennessee TIPA Data Protection Assessment Procedure

And 22 from the standard set, adapted to TN TIPA.