Tennessee. Breach notification. Act

TN breach lawTennessee data breach notification law (Tenn. Code § 47-18-2107)

In force

Partly verified

Medium confidence. No verification notes recorded.

§1Summary

Synopsis

Requires businesses (and in most cases public bodies) that own or license computerised personal information about Tennessee residents to notify affected individuals after a security breach. Core timing rule: Individuals immediately and within 45 days of discovery. Covered data: name plus SSN, driver's licence, financial account or card numbers with codes.

Key themes

breach notification
personal information definition
regulator notice
consumer reporting agency notice
vendor-to-owner notice
encryption safe harbour
substitute notice
law enforcement delay

Unique features

Encryption must meet FIPS 140-2 for the safe harbour; private right of action.

SaaS relevance

A SaaS provider hosting customer data is usually the 'maintaining' entity, not the owner: Tennessee requires the maintaining entity to notify the owner within 45 days of discovery. The owner customer then carries the individual and regulator notices, so contracts should fix timelines and cooperation.

§2Obligations

Extraterritorial: Limited
Breach notification: Individuals immediately and within 45 days of discovery; CRAs if >1,000
DPO: No
Cross-border transfers: None
Maximum penalty: Consumer Protection Act remedies; private actions for damages

§3Dates

Key dates

Adopted 8 June 2005
In force 1 July 2005
SB 547 (2017) latest amendment; SB 2005 (2016) set 45-day deadline

§4Text and authority

Text: No authoritative text located.
Authority: Tennessee Attorney General / Division of Consumer Affairs

§5Where it applies

Domestic law of: Tennessee

§6Sources and verification

Sources consulted

ncsl.org

Verification

Medium confidence.

Partly verified

Medium confidence. No verification notes recorded.