Tennessee SaaS Agreement Review
Tennessee wrote its privacy law for larger companies and built in an unusual reward. The Tennessee Information Protection Act, in force since July 1, 2025, only applies to businesses above $25 million in revenue, and it offers an affirmative defense to those whose privacy programs follow the NIST Privacy Framework. A Nashville healthcare management company or a Memphis logistics firm should check that its vendors fit that program.
Consumer privacy law in Tennessee
Tennessee Information Protection Act (TIPA)
In force since July 1, 2025. Applies only to businesses with more than $25 million in annual revenue that also process data on 175,000 Tennessee consumers, or 25,000 where more than 50% of revenue comes from selling personal data.
Data rights in Tennessee
Tennessee has enacted the Tennessee Information Protection Act (TIPA), a comprehensive consumer privacy law. It gives residents rights over their personal data, typically access, correction, deletion, and the ability to opt out of the sale of data and targeted advertising, and generally requires vendors to sign a data-processing agreement. When you buy SaaS that will hold data about Tennessee residents, the vendor's terms should line up with those obligations.
The clauses that decide your risk
- Data use & AI training, is your data used only to provide the service, or to "improve" (train) the vendor’s models?
- Liability cap, often just one month of fees, against real data-loss exposure
- Auto-renewal, the cancellation-notice window (miss it and you renew for a year)
- Price increases, capped, or unilateral at renewal?
- Data export & deletion on termination, can you get your data out, and is it deleted?
- Uptime SLA and service credits
Who does TIPA cover?
TIPA, at Tenn. Code Ann. 47-18-3201 and following, applies to businesses that operate in Tennessee or target its residents, exceed $25 million in annual revenue, and either control or process personal data of at least 175,000 Tennessee consumers in a year, or of at least 25,000 consumers while deriving more than 50% of gross revenue from selling personal data. That 175,000 figure is higher than most states use.
The attorney general enforces the act, must give 60 days to cure before suing, and may seek penalties of up to $7,500 per violation, with treble damages available at the court's discretion for willful or knowing violations.
Why the NIST Privacy Framework matters for vendors
A controller or processor with a written privacy program that reasonably conforms to the NIST Privacy Framework has an affirmative defense under TIPA. Your SaaS providers process data for you, so ask whether they map their program to NIST, request the mapping document, and require them to keep it up during the term. The processor contract must also cover instructions, confidentiality, deletion or return, subcontractors and assessments.
Tax and breach rules
Under Tenn. Code Ann. 67-6-231, Tennessee taxes the use of remotely accessed software, so SaaS bought for Tennessee users generally carries sales tax, apportioned by user location. Its breach law, Tenn. Code Ann. 47-18-2107, requires notice to residents within 45 days of discovery, so the vendor's reporting deadline to you should be much shorter.
Tennessee sources checked 2026-10-09: Bass Berry & Sims, Tennessee Information Protection Act · Davis Wright Tremaine, Tennessee breach summary · Tenn. Dept. of Revenue Letter Ruling 17-15 (remotely accessed software). Laws change; confirm the current rule before relying on it.
Tennessee SaaS agreement FAQ
Does Tennessee have a data privacy law that affects SaaS contracts?
Yes. Tennessee has enacted a comprehensive consumer privacy law, the Tennessee Information Protection Act (TIPA). It gives residents rights over their personal data (such as access, deletion, and opting out of sale or targeted advertising) and generally requires a data-processing agreement, which shapes what a SaaS vendor can do with data about Tennessee residents. Note the scope: In force since July 1, 2025. Applies only to businesses with more than $25 million in annual revenue that also process data on 175,000 Tennessee consumers, or 25,000 where more than 50% of revenue comes from selling personal data.
Can a SaaS vendor use my Tennessee business's data to train AI?
Only if the contract lets them. Many SaaS agreements grant the vendor a right to use "customer data" to "improve the services," which can extend to training models. Regardless of Tennessee law, insist the contract says your data is never used to train shared or general-purpose models and is processed only to provide the service to you.
What should I check before signing a SaaS agreement in Tennessee?
The clauses that decide your risk: how your data can be used (and whether it trains AI), the liability cap versus your data-loss exposure, auto-renewal and the cancellation-notice window, unilateral price increases, and whether you can export and require deletion of your data on termination. ClauseAudit flags each against Tennessee law in about a minute.
Does TIPA apply to a Tennessee business with $10 million in revenue?
No. TIPA applies only to businesses with more than $25 million in annual revenue that also meet a consumer-count test. A smaller business is outside it, though its SaaS vendors may still be bound by other states' laws, and the breach notice statute applies regardless of size.
How can a Tennessee company use the NIST Privacy Framework defense?
By keeping a written privacy program that reasonably conforms to the NIST Privacy Framework and updating it as the framework changes. Since vendors handle much of your data, require them by contract to support that program, share assessment results and notify you of material changes in their practices.
Reviewing a SaaS contract in Tennessee?
Upload it and get the data, liability, and renewal terms checked against Tennessee law in about a minute.
State privacy-law status summarized as of October 2026; this area changes quickly and thresholds and effective dates vary. This is automated educational information, not legal advice, ClauseAudit verifies current Tennessee law when you run your agreement, and you should confirm anything critical with a qualified attorney.