Bill > SB0073

This bill enacts the "Tennessee Information Protection Act." It establishes various consumer rights and responsibilities for controllers (entities that determine the purpose and means of processing personal information) and processors (entities that process personal information on behalf of controllers). The bill requires controllers to be transparent about their data practices, conduct data protection assessments, and provide consumers the ability to access, correct, delete, and opt out of the sale or targeted use of their personal information. The bill also includes several exemptions, such as for financial institutions, healthcare providers, and certain research activities. The attorney general has exclusive enforcement authority and can seek civil penalties for violations. The bill takes effect on July 1, 2025.