‘Tennessee Information Protection Act’ with NIST Security Standards Enacted

Tennessee Gov. Bill Lee on May 11 signed into law House Bill 1181, making Tennessee the eighth state to enact a comprehensive consumer data privacy law, following California, Virginia, Colorado, Utah, Connecticut, Iowa, and Indiana. The law will take effect July 1, 2024.

Privacy Program

Under the new law, controllers and processors must create, maintain, and comply with a written privacy program that reasonably conforms to the National Institute of Standards and Technology (NIST) Privacy Framework entitled “A Tool for Improving Privacy through Enterprise Risk Management Version 1.0,” and update the program as the Framework is revised.