Tennessee Data Breach Notification Law

The Tennessee data breach notification law: 45 days, no harm exception

Tenn. Code Ann. § 47-18-2107 pairs a fixed deadline with a trigger that leaves no room for a harm analysis ¹. Notice is required whenever personal information was, or is reasonably believed to have been, acquired by an unauthorized person ¹. The business cannot skip the letters on a finding that misuse is unlikely.

The protected identifiers are the familiar ones; health records and online logins are not on the list ¹.

Day one is the day of discovery or of the outside tip, and police may ask for a hold ¹. A company that stores records for a client, such as a payroll processor, has the same 45 days to warn that client ¹.

GLBA Title V and HIPAA entities are carved out of this section ¹; a clinic works from the federal health breach notice rule instead.

A stricter encryption standard

Encrypted data is exempt unless the encryption key was also acquired, and the encryption must meet the FIPS 140-2 standard ¹. Weaker encryption may not count. Ask whoever manages your devices to confirm in writing that laptops, phones and backup drives use encryption that meets FIPS 140-2, and file that note with your incident plan. Because Tennessee has no harm exception, that standard is the only thing standing between a lost laptop and a round of letters.

Who else is told, and the penalties

No state agency receives a copy ¹. The bureaus come in once letters go to more than 1,000 people ¹.

The penalty clause reaches further than most. The Attorney General may sue, and any violation is subject to a civil penalty of the greatest of $10,000, $5,000 per day a person's identity has been assumed, or ten times the amount obtained or attempted ². Those measures were written with identity theft in mind, and how a court would size a penalty for a missed notice is not spelled out.

Injured customers may also sue ¹².

The 45 days, step by step

With the attack still under way, a policyholder phones the carrier first, reports the crime through ic3.gov, and keeps every affected system as it is until it has been imaged ⁴⁷⁵. Tennesseans sent IC3 16,261 complaints in 2025, with about $269 million in reported losses ⁶.

1. Get a breach containment team, or the company that manages your computers, to cut the attacker off.
2. Read the policy before hiring a lawyer or forensic firm; many carriers choose them, as what insurers require of small firms explains.
3. Split the list by home state. A Kentucky or Georgia resident brings that state's law; the state comparison chart has each one.
4. Circle day 45 on the calendar. Concluding that misuse is unlikely does not pause it.

The Tennessee Information Protection Act, effective July 1, 2025, touches only bigger firms: more than $25 million in revenue plus data on at least 175,000 Tennessee consumers a year, or 25,000 when over 50% of gross revenue comes from selling it ³. The breach notice section was left as it was ¹. Our Nashville, Memphis and Chattanooga pages cover local IT support pricing.

Our reading of § 47-18-2107 was last compared with the code on October 13, 2026. Use it as orientation rather than legal advice, and have a Tennessee lawyer confirm your duties.