DATA PROTECTION IMPACT ASSESSMENT (DPIA)

(State overlay: TN)

1. Project Overview

• Project name/ID: [name]; owner: [business owner]; sponsor: [executive].
• Purpose and objectives: [describe].
• Timeline and launch date: [dates].

2. Scope of Processing

• Data subjects: [customers/employees/vendors/end users].
• Personal data categories: [contact, IDs, financial, location, biometric, health, minors].
• Sensitive data (TIPA): ☐ Racial/ethnic origin; ☐ Religious beliefs; ☐ Mental/physical health; ☐ Sexual orientation; ☐ Citizenship/immigration; ☐ Genetic/biometric; ☐ Child (under 13); ☐ Precise geolocation. Opt-in consent required (GDPR-style).
• Volume/retention: [records/year], [retention per purpose].
• Processing: [collection, storage, analysis, sale].

3. Legal Basis, Notices, and Rights

• Primary law: Tennessee Information Protection Act (TIPA), effective July 1, 2025.
• HIGHEST THRESHOLDS: $25M+ revenue AND (175,000+ TN consumers OR 25,000+ + >50% sale). Highest consumer threshold of any state.
• Exemptions: Government, nonprofits, HIPAA, GLBA, higher ed, licensed insurers.
• Rights: Confirm/access, correct, delete, portability, opt-out sale/targeted ads/profiling. Response: 45 days + 45-day extension. Appeals: 60 days.
• GDPR-style opt-in for sensitive data (uncommon in US laws).

4. Data Flow and Transfers

• Source systems: [list]; storage/hosting locations: [cloud region/data centers].
• Cross-border transfers: [EU/UK/other]; transfer tool: [SCCs/IDTA/CBPR if applicable].
• Recipients/vendors: [processors/subprocessors/controllers]; due diligence status and DPAs in place.
• Access controls: RBAC groups, least privilege, joiner/mover/leaver process.

5. Security and Controls

• Technical controls: encryption in transit/at rest [specify], key management, network segmentation, endpoint protections, logging/monitoring, DLP, backups, vulnerability management.
• Organizational controls: policies, training cadence, vendor due diligence, incident response playbook, change management.
• Authentication/authorization: [MFA/SAML/SSO]; session timeouts; privileged access reviews cadence.

6. Risks and Impact Assessment

• Risks/threats: [unauthorized access, data minimization failure, purpose creep, profiling risk, transfer risk, children/minors risk].
• Likelihood: [low/medium/high]; Impact: [low/medium/high]; Risk rating matrix: [insert].
• POWR/State-specific equal employment or anti-discrimination considerations (if applicable): [insert].

7. Mitigations and Residual Risk

• Planned mitigations: [controls, timelines, owners].
• Testing/validation: [pen test, DPIA/ROPA updates, privacy-by-design checklist].
• Residual risk after mitigations: [rating]; decision: [accept/mitigate further/block].

8. Incident Response and Breach Notification

• Statute: Tenn. Code Ann. § 47-18-2107 (Information Protection Act); effective July 1, 2005; amended 2016, 2023 (updates re: electronic notice).
• Timeline: Without unreasonable delay. Must notify affected persons. If 1,000+, notify consumer reporting agencies and notify the TN Attorney General without unreasonable delay.
• Triggers: Unauthorized acquisition of unencrypted/unredacted PI compromising security/confidentiality. PI = first name/initial + last name + (SSN, DL, financial account, or health insurance ID).
• Exception: No notice if after investigation, no reasonable likelihood of harm; document in writing. Law enforcement delay permitted.
• Coordination with other states/GLBA/HIPAA requirements if multi-state: [plan].

9. State Overlay Checklist (TN)

• Applicability: $25M+ revenue AND (175,000+ TN consumers OR 25,000+ + >50% revenue from sale). Highest consumer threshold of any state law. Exemptions: Nonprofits, HIPAA, GLBA, higher ed, government, licensed insurers.
• Sensitive data: 8 categories with GDPR-style opt-in (unique among US laws): racial/ethnic origin, religious beliefs, mental/physical health, sexual orientation, citizenship/immigration, genetic/biometric, child (under 13), precise geolocation.
• Consumer rights: Confirm/access, correct, delete, portability, opt-out of sale/targeted ads/profiling. Response: 45 days + 45-day extension. Appeals: 60 days.
• Opt-out: Sale, targeted advertising, profiling (with legal/significant effects).
• Processor contracts: Instructions, data types, duration, obligations, deletion/return, consumer rights assistance, confidentiality, subprocessor notice.
• DPA triggers: Required for sale, targeted advertising, profiling with legal/significant effects, or sensitive data processing.
• Security: Reasonable administrative, technical, and physical safeguards appropriate to data volume and nature.
• Breach notice: TN AG + consumers without unreasonable delay. If 1,000+, notify CRAs. Exception if no reasonable likelihood of harm (document in writing).
• Children: Under 13 data is sensitive requiring opt-in consent. COPPA compliance required.
• Non-discrimination: Cannot deny goods/services, charge different prices, or provide different quality/level for exercising rights.
• Recordkeeping: 60-day cure period (permanent, no sunset). AG exclusive enforcement. No private right of action. Penalties up to $15,000 per violation.

10. Approvals and Accountability

• Privacy lead/DPO review: [name/date].
• Security review: [name/date].
• Legal review (state law overlay): [name/date].
• Business owner certification: [name/date].
• Executive approver: [name/title/date].

11. Attachments

• Data flow diagrams/architecture.
• Records of processing activities entry.
• Vendor list and DPAs/SCCs.
• Legitimate interests assessment or risk assessment (if applicable).
• Testing summaries and pen test reports (if applicable).
• State-specific notices/links and breach templates.