Skip to content
770-587-4595

Cyber Liability by state

Tennessee data breach notification law and cyber insurance

Direct answer

What is Tennessee's data breach notification law?

Tennessee's breach notification law (Tenn. Code sect. 47-18-2107) requires businesses to notify affected residents in the most expedient time possible and without unreasonable delay, but no later than 45 days after discovery of the breach after a breach of personal information.

Reviewed by Cornerstone Staff28 years of financial services state licensing experienceLast verified July 29, 2026

What the statute requires

Tennessee requires businesses to notify affected residents within 45 days of discovering a breach of unencrypted personal information. Cyber liability insurance typically covers the forensics, notification, and legal review this deadline demands.

Consumer notification deadline
In the most expedient time possible and without unreasonable delay, but no later than 45 days after discovery of the breach
Credit bureau notice
Notify consumer reporting agencies when a breach requires notice to more than 1,000 residents.
Safe harbor
Notification is not required if the compromised data was encrypted and the encryption key was not acquired.
Enforcement
Affected residents may bring a civil action to recover damages, and violations are enforceable under the state's consumer protection law.

Statutes and sources

  • Tennessee Identity Theft Deterrence Act

    Tenn. Code sect. 47-18-2107

Regulator: Tennessee Attorney General . Last verified 2026-07-29 from the official source .

Related Tennessee compliance pages

Insurance

Tennessee workers' compensation

Licensing and bonds

Tennessee licensing, bond, and regulator directory

Cyber Liability in other states

Back to the cyber liability coverage guide

Get Tennessee coverage handled

Share a few details and an agent will respond within one business day.

Request a quote Talk to an agent