Data Breach Notice to Residents and State Authorities in Tennessee
At a glance
| Covered entity and service provider | TN business/person owning or licensing resident computerized PI: resident notice; nonowner holder: owner/licensee notice, each within 45 days (§ 47-18-2107(a)(3), (b)-(c)) |
|---|---|
| Breach and covered information | Unauthorized acquisition materially compromises unencrypted computerized PI or encrypted data plus key; name + SSN, driver license, or account/payment-card number with access credential (§ 47-18-2107(a)(1),(4)) |
| Risk screen or notice exception | No general post-breach harm waiver; good-faith employee acquisition excluded absent use/further disclosure; public/redacted/unusable information excluded (§ 47-18-2107(a)(1),(4)) |
| Individuals who receive notice | TN resident whose PI was or reasonably may have been acquired by unauthorized person; nonowner holder instead tells owner/licensee (§ 47-18-2107(b)-(c)) |
| Individual notice deadline and clock | No later than 45 days after discovery or notification of breach, subject to law-enforcement delay (§ 47-18-2107(b),(d)) |
| Regulator threshold and deadline | No AG or other state-regulator notice route in this general breach-notice section (§ 47-18-2107(b)-(g)) |
| Consumer-reporting-agency notice | More than 1,000 persons at one time: all nationwide consumer reporting agencies and credit bureaus, timing/distribution/content, without unreasonable delay (§ 47-18-2107(g)) |
| Individual delivery and content | Writing or qualifying electronic notice, including primary-electronic-communication route; § 47-18-2107(e) prescribes no consumer-letter content list |
| Substitute notice conditions and channels | Cost >$250,000, class >500,000, or insufficient contacts; email where available AND website if maintained AND major statewide media (§ 47-18-2107(e)(3)) |
| Delays and alternate compliance | Law-enforcement finding that notice impedes investigation; notice within 45 days after clearance. Timely consistent own-policy notice qualifies; GLBA/HIPAA-regulated holders excluded (§ 47-18-2107(d),(f),(i)) |
Requirements one by one
Covered breach and information
Tenn. Code Ann. § 47-18-2107(a) defines a breach as unauthorized acquisition that materially compromises unencrypted computerized personal information, or encrypted computerized data together with its encryption key. Personal information combines a name or first initial and surname with a Social Security number, driver license number, or financial account or payment card number plus a required access credential. Lawfully public, redacted, or otherwise unusable information is excluded. Good-faith employee acquisition for the holder's purposes is excluded unless the information is used or further disclosed without authorization.
Recipient and 45-day clock
Under § 47-18-2107(b), an owner or licensor notifies a Tennessee resident whose information was or reasonably may have been acquired by an unauthorized person. Notice is due no later than 45 days after the holder discovers the breach or is notified of it. A nonowner holder instead notifies the owner or licensor within that same period under subsection (c).
Credit-agency and delivery rules
When one incident requires notice to more than 1,000 people at one time, § 47-18-2107(g) also requires notice without unreasonable delay to the nationwide consumer reporting agencies and credit bureaus, describing the timing, distribution, and content of the resident notices. The general section does not prescribe an Attorney General or other state-regulator report.
Section 47-18-2107(e) permits written notice or qualifying electronic notice. Electronic notice also qualifies when the holder has primarily communicated with the resident electronically. The section gives no required consumer-letter content list. Substitute notice requires a cost above $250,000, a class exceeding 500,000 people, or insufficient contact information; then email where possible, website posting if there is a site, and major statewide media notice are all required.
What trips people up
The clock starts on discovery or notification. Section 47-18-2107(b)-(c) does not wait for a final count or a later internal determination.
A police delay changes the deadline. Section 47-18-2107(d) allows delay when law enforcement determines that notice will impede a criminal investigation. Once it determines notice will no longer compromise the investigation, notice is due within 45 days.
Some regulated holders are outside this section. Section 47-18-2107(i) excludes holders subject to the specified Gramm-Leach-Bliley or HIPAA rules. A holder's own security-policy notice procedures can satisfy subsection (f) if they meet the statutory timing.
Common questions
Does encrypted information always fall outside the law?
No. Section 47-18-2107(a)(1) includes encrypted computerized data when an unauthorized person also acquires its encryption key.
Does the service provider notify residents directly?
The nonowner holder's notice under § 47-18-2107(c) goes to the owner or licensor. The owner or licensor has the resident duty under subsection (b).
Statutes and sources
- Tenn. Code Ann. § 47-18-2107, as replaced by 2017 Pub. Ch. 91 — breach definitions and notification duties. Official replacement text accessed October 14, 2026.
Source links
Every statute quoted above, linked, with the date we checked it.
What does Tennessee law mean for your facts?
You just read the general rule. Ask your own question and see which parts of current Tennessee law apply to your situation, with citations you can check.
Try Ezel Pro free for 7 days. Cancel anytime before the trial ends and you pay nothing.
- Starts from the statutes this survey is built on
- Cites every source it relies on, so you can verify it
- Chat, drafting and research in one workspace