Tennessee data breach notification law

Who must notify and when

45 days Tennessee requires businesses and persons to notify affected individuals no later than 45 days

Attorney general notice

No Tennessee does not require notification to the Attorney General or any state agency as part of its

What counts as a breach

In Tennessee 'breach of system security' means the acquisition of unencrypted computerized data, or encrypted computerized data and the encryption key, by an unauthorized person that materially compromises the security, confidentiality, or integrity of personal information maintained by the information holder; it does not include good faith acquisition by an employee or agent for the purposes of the information holder if the personal information is not used or subject to further unauthorized dis

What counts as personal information

In Tennessee 'personal information' means an individual's first name or first initial and last name, in combination with any one or more of the following data elements: (i) Social security number; (ii) Driver license number; or (iii) Account, credit card, or debit card number, in combination with any required security code, access code, or password that would permit access to an individual's financial account; it does not include information lawfully made available to the general public from gov

Coverage and remedies

"Not extracted" means the field was not captured in our PRC 2026 summary; check the statute.

HIPAA breaches reported in Tennessee

200 reports to HHS OCR affecting 39,597,433 individuals. Most common type: Hacking/IT Incident. See all HIPAA breaches in Tennessee.

Frequently asked questions