Compare tool
Compare state data breach notification laws
Choose up to six states. Fields come from the PRC 2026 survey extract; blanks show as not extracted.
| Field | Tennessee |
|---|---|
| Statute citation | Tenn. Code Ann. §§ 47-18-2101 to 47-18-2111 (Tennessee Identity Theft Deterrence Act of 1999) (amended 2025) |
| Individual notice timing | 45 days Tennessee requires businesses and persons to notify affected individuals no later than 45 days |
| Attorney general notice | No Tennessee does not require notification to the Attorney General or any state agency as part of its |
| Biometric data | No |
| Medical information | No |
| Government ID numbers | Not extracted |
| Paper records | No |
| Private right of action | Yes |
| Credit monitoring required | No |
| Breach definition (excerpt) | In Tennessee 'breach of system security' means the acquisition of unencrypted computerized data, or encrypted computerized data and the encryption key, by an unauthorized person that materially compromises the security, confidentiality, or integrity of personal information maintained by the information holder; it does not include good faith acquisition by an employee or agent for the purposes of the information holder if the personal information is not used or subject to further unauthorized dis |