Tennessee Data Breach Law

March 28, 2025

What Are Tennessee’s Breach Laws?

Tennessee Cyber & Data Security Laws, as well as Cybersecurity Data Breach Laws apply to businesses of different types, with various exemptions available. The two main sections discussed here cover the Insurance Data Security Law and the rules that govern a breach.

Tennessee Insurance Data Security Law

Tennessee passed an Insurance Data Security Law which took effect July 1, 2021. It is based upon the NAIC Data Security Model Law that is present in over 20 States.

The law modernized, defined and toughened existing security measures that Tennessee insurance carriers must take to protect consumer information. Under the law, insurance carriers must:

Identify internal or external threats that could result in unauthorized access, transmission, disclosure, misuse or destruction of consumers’ private information.
Develop, implement and maintain an information security program based on its individual risk assessment with a designated employee in charge of the information security program.
Investigate any cybersecurity breach and notify the Insurance Commissioner of a cybersecurity event if the licensee is a domiciled insurer or if more than 250 Tennesseans are impacted.

Report a Cyber Security Event

A licensee must notify the Insurance Commissioner of a cyber security event in accordance with Tennessee Code Annotated, Title 56, Chapter 2. To report a new cyber security event or update an existing cyber security event, licensees can select the following link

Compliance (Self) Certification

Each insurer domiciled in Tennessee who does not qualify for an exemption must annually, on or before April 15th, submit a written statement to the Commissioner of the Department of Commerce and Insurance certifying that the insurer is in compliance with the Insurance Data Security Law. The Compliance Certification form can be accessed here. Submit a Compliance Certification to Insurance.DataSecurity@tn.gov

Exceptions to the Insurance Data Security Law

A licensee or employees, agents, representatives, or designees of a licensee, may be exempted from the required compliance certification pursuant to the Insurance Data Security Law if they meet any of the following criteria:

Employs fewer than twenty-five (25) individuals, regardless of whether the individuals are employees or independent contractors.
Has less than five million dollars ($5,000,000) in gross annual revenue.
Has less than ten million dollars ($10,000,000) in year-end total assets.

Exemptions are also applicable to companies compliant with HIPAA &GLBA;

Subject to and governed by the privacy, security, and breach notification rules under the federal Health Insurance Portability and Accountability Act (“HIPAA”) of 1996 (42 U.S.C. § 1320d et seq.), and the federal Health Information Technology for Economic and Clinical Health (“HITECH”) Act (42 U.S.C. § 300jj et seq. and 42 U.S.C. § 17901 et seq.). To be eligible for this exemption, the Company must (1) maintain nonpublic information in the same manner as protected health information as outlined in Tenn. Code Ann. §§ 56-2-1004 and 56-2-1006(c); and (2) be compliant with, and, prior to or contemporaneous with this form, submit a written statement to the Department certifying its compliance with HIPPA and HITECH Act.
Subject to Title V of the federal Gramm-Leach-Bliley Act of 1999 (15 U.S.C. §§ 6801-6809 and 6821-6827) and meets the requirements of Tenn. Code Ann. § 56- 2-1006(c). To be eligible for this exemption, the Company must, prior to or contemporaneous with this form, submit a written statement to the Department certifying its compliance with Title V of the federal Gramm-Leach-Bliley Act of 1999.

In order to validate the exception qualification, a written Exemption Certification form must be completed and returned to the Insurance Division. Exemption Certification Form link. To Submit an Exemption Certification use Insurance.DataSecurity@tn.gov

If a licensee does not meet any of the exception criteria, they must complete a Compliance Certification form.

Tennessee Cyber & Data Security Laws include aData Breach Requirement

State Data Breach & Cybersecurity Requirements

Tennessee Cyber & Data Security Laws include 2010 Tennessee Code Consumer Protection Act

In Tennessee, data breach notification laws require businesses that own, license, or maintain covered information to notify individuals whose personal information was, or is reasonably believed to have been, acquired by an unauthorized person, within 45 days of the breach’s discovery. Tenn. Code § 47-18-2107

Scope of Summary:

Notification requirements applicable to persons or businesses that conduct business in the state that own, license, or maintain covered info. Some types of businesses may be exempt from some or all of these requirements, and non-commercial entities may be subject to different requirements.

Risk of Harm Threshold

Notification is required only if the unauthorized acquisition of computerized data materially compromises the security, confidentiality, or integrity of personal information the information holder maintains.

Breach Defined

Unauthorized acquisition that materially compromises the security, confidentiality, or integrity of the covered info, excluding certain good-faith acquisitions by employees or agents.

Encryption Safe Harbor

The unauthorized acquisition of encrypted nonpublic information is not considered a cybersecurity event if the encryption, process, or key is not also acquired, released, or used without authorization.

Form of Covered Info

Electronic Only

Covered Information

An individual’s first name or first initial and last name, in combination with any one or more of the following data elements:

Social security number.
Driver’s license number.
Account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individual’s financial account.

Consumer Notice Timing

Must be made no later than 45 days after discovery or notification of the breach.

Consumer Notice Method

By written notice or electronic notice (if consistent with E-SIGN or the primary method of communication with the resident). Substitute notice is available if certain criteria are satisfied.

Consumer Notice Content

Tennessee does not have specific content requirements for the notice to affected individuals.

Delayed Notice

Notification may be delayed if law enforcement determines notice will impede a criminal investigation. If notification is delayed, it must be made no later than 45 days after law enforcement determines that notification will not compromise the investigation.

Government Notice

The Tennessee statute does not require notice to any government or regulatory agencies.

Consumer Reporting Agency Notice

If more than 1,000 residents are notified, must notify, without unreasonable delay, all nationwide Consumer Reporting Agencies of timing, distribution, and content of the consumer notice.

Exceptions for other laws

Information holders subject to either the Gramm-Leach-Bliley Act (GLBA) or the Health Information Portability and Accountability Act (HIPAA) are exempt from the statute.

Third-Party Notice

If you maintain covered info on behalf of another entity, you must notify it no later than 45 days following discovery of a breach.

Private Right of Action

Under the Tennessee general breach notification statute, a Tennessee person or business entity who is a customer of an information holder and is injured by a violation of the statute may institute a civil action to recover damages and enjoin the information holder from further action in violation of the statute.

Potential Penalties

Violations may result in civil penalties.

Tennessee Cyber & Data Security Laws include an Identity Theft Deterrence Act of 1999.

When Do You Need to Report a Breach?

Any person or company conducting business in Tennessee must follow the state’s data breach laws, which require businesses to inform their customers when their data is compromised in a breach. If more than 1,000 Tennessee residents are affected by a breach, businesses will also have to report the breach to consumer reporting agencies.

Name of Law / Statute	Tennessee Identity Theft Deterrence Act of 1999
Definition of Protected Information	Combination of (1) name or other identifying info, PLUS (2) one or more of these “data” elements: SSN; driver’s license number; or account number, credit card number, debit card number if accompanied by PIN, password, or access codes.
Who Is Subject to Law?	“Information holders,” defined as any person or business conducting business in the state who licenses or owns PI
Notification of Consumers?	Yes
By what means?	Written or electronic; if >1,000 residents, must notify consumer reporting agencies
Substitute Notice Threshold?	If cost of notice >$250,000 or involves >500k residents
Notification of authorities / regulators required?	No
By what means?	N/A
Regulatory Fines	N/A
Credit monitoring requirement?	No
Private lawsuits allowed?	Yes
Private damages cap?	Actual damages (treble for willful violation) + costs, attorney fees
Regulatory actions allowed?	Yes
HIPAA Compliance exemption?	N/A
Other (e.g., timeframe)	Law does not apply if PI was encrypted
Link to complete law	Tennessee’s data breach law

Categories: Breach Laws, States

Tags: Tennessee, Law, Breach, cyber, insurance, compliance, cyber risk assessment, GLBA, HIPAA

South Dakota Cybersecurity Law

Why Should Your Business Use DNS Filtering?