1. Home
  2. State breach laws
  3. Tennessee

Tennessee data breach notification law

What Tennessee requires when personal information is exposed: how fast residents must be notified, when the Attorney General has to be told, what it costs to get it wrong, and whether affected people can sue. Governed by Tenn. Code Ann. § 47-18-2107.

45 days
Notification deadline
Not required
AG notification
Yes
Private right of action
Limits class actions
Liability protection

What this means if you sell security services

Tennessee's 45-day notification window means filings surface while remediation is still underway and the organization is still deciding what to change. There is no Attorney General notice requirement, so Tennessee incidents surface mainly through SEC and HHS filings and through other states' records, channels fewer competitors watch. A private right of action adds lawsuit exposure on top of regulatory cost, which makes incident-readiness, documented controls, and evidence-quality logging an easy conversation.

See recent Tennessee breach filings →

Requirements in detail

Statute
Tenn. Code Ann. § 47-18-2107
Deadline to notify residents
No later than 45 days after discovering or being notified of the breach. If law enforcement determines that notice would impede a criminal investigation, notice may be delayed, but it must go out no later than 45 days after law enforcement determines that notice will not compromise the investigation.
Attorney General notification
No. The breach notification statute does not require notice to the Attorney General. Consumer reporting agencies must be notified without unreasonable delay when more than 1,000 people are notified at one time.
Penalties
Injured customers may sue for damages and an injunction. The Attorney General may also sue under the Identity Theft Deterrence Act (Tenn. Code Ann. § 47-18-2105), which provides a civil penalty of the greater of $10,000, $5,000 per day that a person's identity has been assumed, or ten times the amount obtained or attempted to be obtained, in addition to Tennessee Consumer Protection Act remedies.
Private right of action
Yes. Affected individuals can bring a private lawsuit under the breach notification law.
Encryption exemption
Tennessee's notification requirements apply to unencrypted personal information. Encrypted data generally doesn't trigger notice unless the encryption key or credentials were also compromised.
Liability protection for security programs
Tennessee (2024) bars class-action liability for a cybersecurity event unless it was caused by willful and wanton misconduct or gross negligence. No security program is required to qualify. These protections limit lawsuits; they don't change the duty to notify. Tenn. Pub. Ch. 991 (2024), HB 2434
Recent changes
None to the breach notification statute in 2024–2026. The separate Tennessee Information Protection Act, a comprehensive privacy law enforced by the Attorney General, took effect on July 1, 2025.

Tennessee breach notification FAQ

What is the data breach notification deadline in Tennessee?

No later than 45 days after discovering or being notified of the breach. If law enforcement determines that notice would impede a criminal investigation, notice may be delayed, but it must go out no later than 45 days after law enforcement determines that notice will not compromise the investigation. The governing law is Tenn. Code Ann. § 47-18-2107.

Does Tennessee require notifying the Attorney General of a data breach?

No. The breach notification statute does not require notice to the Attorney General. Consumer reporting agencies must be notified without unreasonable delay when more than 1,000 people are notified at one time.

What are the penalties for failing to report a data breach in Tennessee?

Injured customers may sue for damages and an injunction. The Attorney General may also sue under the Identity Theft Deterrence Act (Tenn. Code Ann. § 47-18-2105), which provides a civil penalty of the greater of $10,000, $5,000 per day that a person's identity has been assumed, or ten times the amount obtained or attempted to be obtained, in addition to Tennessee Consumer Protection Act remedies.

Can individuals sue over a data breach in Tennessee?

Yes. Affected individuals can bring a private lawsuit under the breach notification law.

Does encrypted data need to be reported in Tennessee?

Tennessee's notification requirements apply to unencrypted personal information. Encrypted data generally doesn't trigger notice unless the encryption key or credentials were also compromised.

Does Tennessee limit breach lawsuits for companies with a cybersecurity program?

Tennessee (2024) bars class-action liability for a cybersecurity event unless it was caused by willful and wanton misconduct or gross negligence. No security program is required to qualify. These protections limit lawsuits; they don't change the duty to notify.

Last reviewed October 5, 2026. This summary is for general information and is not legal advice. Statutes change; confirm current requirements with counsel or the Tennessee Attorney General before relying on them.

Other states with a 45-day deadline

Breach notification laws by state

Compare all 51 jurisdictions on the interactive map →·US data breach statistics →