← All US breach laws·TN

Tennessee data breach notification law

Tennessee's data breach notification requirements under Tenn. Code §47-18-2107. Below: the resident-notification deadline, AG/regulator filing threshold, the encryption safe harbor, private right of action exposure, penalty schedule, and the common pitfalls that turn an avoidable incident into a regulator enforcement action.

Statute
Tenn. Code §47-18-2107
Enforcer
Tennessee Attorney General — Consumer Protection
AG notification
Not required
Private right of action
Yes — residents can sue

Notification deadlines

Notify affected residents
Immediately, but no later than 45 days from discovery of the breach
Notify the state regulator
No general AG-notice requirement
Notify consumer reporting agencies
Yes — if more than 1,000 residents, notify nationwide CRAs

When is notification required?

Trigger / harm threshold
Notification required upon discovery or notification of a breach involving PI — Tennessee is largely a no-harm-threshold state since 2016 amendments
Encryption safe harbor
Yes — properly encrypted personal information is generally exempt from notification, provided the encryption key was not also compromised.

What counts as "personal information" under Tennessee law

First name/initial + last name with SSN, DL/state ID, financial account + access code

Penalties and enforcement

Up to $10,000 per violation under Consumer Protection Act; private right of action for damages
Enforced by: Tennessee Attorney General — Consumer Protection. Official regulator page →

Common pitfalls

⚠ Tennessee's 2016 amendments removed the harm-based exception for many breaches — assume notification is required upon discovery

Frequently asked questions

How long do I have to notify Tennessee residents after a data breach?
Immediately, but no later than 45 days from discovery of the breach
Do I have to notify the Tennessee Attorney General?
No general AG-notice requirement
Does Tennessee require notification to nationwide consumer reporting agencies?
Yes — if more than 1,000 residents, notify nationwide CRAs
Is encrypted data exempt from Tennessee's breach notification requirement?
Yes — Tennessee has an encryption safe harbor. Breaches of properly encrypted personal information generally do not trigger notification, provided the encryption key was not also compromised.
Can Tennessee residents sue me directly for a data breach?
Yes — Tennessee allows a private right of action. Affected residents may sue for actual damages and, in some cases, statutory damages or attorneys' fees. Class actions are common.
What counts as 'personal information' under Tennessee law?
First name/initial + last name with SSN, DL/state ID, financial account + access code
What are the penalties for failing to comply with Tennessee's breach notification law?
Up to $10,000 per violation under Consumer Protection Act; private right of action for damages

Related state breach laws

South Carolina (SC)
S.C. Code §39-1-90
South Dakota (SD)
S.D. Codified Laws §§22-40-19 to 22-40-26
Texas (TX)
Tex. Bus. & Com. Code §521.053
Utah (UT)
Utah Code §§13-44-101 to 13-44-301

Pre-empt the Tennessee breach notice — audit your policy now

ComplianceIQ runs a free audit of your privacy policy and incident-response language against Tennessee's statutory requirements. You'll see every gap before you have to use it for real.

Run free policy audit