Tennessee Code Title 49. Education § 49-7-186

A public institution of higher learning that holds personal information of students, including, but not limited to, names;  campus, home, or email addresses;  telephone numbers;  or other identifying information, shall not share the personal information with a third party that has contracted with the public institution to input personal information of students for administrative purposes, unless the third-party contractor agrees in writing that the personal information will only be used for the purpose for which the information is originally provided to the third-party contractor and will not be sold to or shared with any other entity.