Highlights

Covered Entities: Any person or business that conducts business in Tennessee, or any agency of Tennessee or any of its political subdivisions, that owns or licenses computerized personal information of Tennessee residents.

Consumer Notification: Notification must be provided to any Tennessee resident whose personal information was, or is reasonably believed to have been, acquired by an unauthorized person.

Regulatory Notification: State agencies and political subdivisions must report a breach to the Comptroller of the Treasury within five (5) working days of discovery.

Notification Timeline: Notification must be provided no later than 45 days from the discovery or notification of the breach of system security.

Data Format: Electronic.

Citations: Tenn. Code § 47-18-2107 & § 8-4-119...

More Details

Definitions:

• Breach: Acquisition of unencrypted computerized data or encrypted computerized data along with the encryption key by an unauthorized person that materially compromises the security, confidentiality, or integrity of personal information.
• Personal Information (PI): An individual's first name / first initial and last name, in combination with any one or more of the following data elements:
  • Social Security number;
  • Driver license number; or
  • Account, credit card, or debit card number, in combination with any required security code, access code, or password that would permit access to an individual's financial account.
• Medical Information: N/A
• Health Insurance Information: N/A

Safe Harbors:

• Encryption: Notification is not required where personal information was rendered unusable, unreadable, or indecipherable without the use of a decryption process or key.
• Good Faith: Notification is not required where the personal information was acquired in good faith by an employee or agent of the information holder for the purposes of the information holder, if the personal information is not used or subject to further unauthorized disclosure.
• Risk of Harm: N/A
• Law Enforcement Delay: Notification may be delayed if a law enforcement agency determines that notification will impede a criminal investigation. If the notification is delayed, it must be made no later than forty-five (45) days after the law enforcement agency determines that notification will not compromise the investigation.
• Public Record: Personal information does not include information lawfully made available to the general public from federal, state, or local government records, or information that has been redacted or otherwise made unusable

Direct Notice:

• Timing: Notification must be provided no later than forty-five (45) days from the discovery or notification of the breach of system security, unless a longer period of time is required due to the legitimate needs of law enforcement.
• Format: N/A
• Content: N/A
• Method: Notification must be provided via written notice or electronic notice, if the notice provided is consistent with the provisions regarding electronic records and signatures set forth in 15 U.S.C. § 7001 or if the information holder’s primary method of communication with the resident of this state has been by electronic means.  Alternatively, if a person or business maintains their own notification procedures as part of an information security policy, and is otherwise consistent with this state’s statutory notification timing requirements, they shall be deemed to be in compliance with the notification requirements, if the person or business notifies subject persons in accordance with its policies in the event of a breach of system security.

Substitute Notice:

An entity may provide substitute notice, if the information holder demonstrates that (1) the cost of providing notice would exceed $250,000, (2) the affected class of subject persons to be notified exceeds 500,000, or (3) the information holder does not have sufficient contact information. Substitute notice must consist of all of the following:

• Email notice, when the information holder has an email address for the subject persons;
• Conspicuous posting of the notice on the information holder's website, if the information holder maintains a website page; and
• Notification to major statewide media.

Remediation Services:

N/A

Regulatory Notice:

N/A

Credit Reporting Agencies Notice:

If notification must be provided to 1,000 persons at one  time, the information holder must also notify, without unreasonable delay, all consumer reporting agencies and credit bureaus that compile and maintain files on consumers on a nationwide basis, of the timing, distribution, and content of the notices.

Third-Party Notice:

An information holder that maintains computerized data that includes personal information that the information holder does not own shall notify the owner or licensee of the information of any breach of system security if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person within 45 days.

HIPAA:

This section does not apply to an information holder that is subject to Title V of the GLBA or HIPAA.

Private Action:

Any customer of an information holder who is a person or business entity, but who is not an agency of this state or any political subdivision of this state, and who is injured by a violation of this section, may institute a civil action to recover damages and to enjoin the information holder from further action in violation of this section. The rights and remedies available under this section are cumulative to each other and to any other rights and remedies available under law.

Associated Regulations:

• Insurance Data Security (Tenn. Code Ann. §§ 56-2-1001 to 56-2-1011)
• Tennessee Information Protection Act (TIPA)

Tennessee Information Protection Act (TIPA)

Tennessee Code Annotated, §§ 47–18–3201–3213

Highlights

Applicability:

Controllers that conduct business in Tennessee or produce or deliver commercial products or services intentionally targeted to Tennessee residents and that:

• Exceed twenty-five million dollars ($25,000,000) in revenue; and
• Control or process Personal Information of 25,000 or more consumers and derive more than fifty percent (50%) of gross revenue from personal information sales; or
• During a calendar year, control or process personal information of 175,000 consumers or more.

TIPA excludes from its scope certain entities, such as state and local government, financial institutions subject to Title V of the GLBA, insurance companies regulated under state law, entities subject to the privacy and security rule of HIPAA and HITECH, non-profits, and institutions of higher education. In addition the Act excludes from its scope certain types of information such as information protected by HIPAA, health records, patient identifying information, personal information processed for purpose of certain types of research, information regulated by Health Care Quality Improvement Act of 1986, by Patient Safety and Quality Improvement Act, by the Fair Credit Reporting Act, Drivers Privacy Protection Act, Family Educational Rights and Privacy Act, Farm Credit Act, as well as employment-related data.

Covered Entity Obligations:

Controllers:

• Limit the collection of Personal Information to that which is adequate, relevant, and reasonably necessary to the purpose for which the information is processed, as disclosed to consumer.
• Refrain from processing Personal Information for purposes that are beyond reasonably necessary and compatible with the purposes disclosed to the consumer unless the consumer’s consent has been obtained.
• Establish, implement, and maintain reasonable administrative, technical, and physical data security procedures and practices commensurate with the nature of the personal information so as to protect the confidentiality, integrity, and accessibility of Personal Information.
• Comply with data consumer requests in a timely and efficient manner.
• Not process Personal Information in violation of state and federal laws that prohibit discrimination against consumers and not discriminate against consumers who exercise such rights.
• Obtain consent for processing Sensitive Personal Information from consumers and comply with applicable regulations when processing Personal Information of a known child.
• Provide consumers with a reasonably accessible and clear privacy notice that describes the categories of Personal Information processed by the controller; the purpose for processing the personal information and whether such information is sold or shared and to whom; and how consumers may exercise their individual rights, including how a consumer may appeal a controller’s decision regarding a consumer’s request.
• Provide consumers with one or more secure and reliable means for them to submit a request to exercise their consumer rights, taking into account a consumer’s normal interactions and communication needs and a controller’s ability to authenticate the identity of the consumer.
• Establish binding contractual arrangements with processors and third parties clearly outlining their roles and responsibilities.
• Conduct and document a data protection assessment before conducting processing activities that present a heightened risk of consumer harm, such as for:
  
  • Targeted advertising.
  • Selling Personal Information
  • Profiling that presents a reasonably foreseeable risk of: unfair or deceptive treatment of or unlawful disparate impact on consumers; financial, physical, or reputational injury to consumers; a physical or other intrusion on consumers' solitude, seclusion, private affairs, or private concerns, if it would offend a reasonable person; or another substantial consumer injury.
  • Processing Sensitive Data.

Consumer Rights:

A Controller must respond without undue delay and within 45 days to verified consumer requests regarding the processing of Personal Information and Sensitive Personal Information, including consumers’:

• Right to know and access Personal Information;
• Right to correct inaccurate Personal Information;
• Right to request deletion of Personal Information;
• Right to obtain Personal Information in a format that is generally portable, readily usable, and transmittable;
• Right to opt out of Personal Information sales, targeting advertising, and profiling for decisions producing legal or other similarly significant effects concerning the consumer.
• Right to non-discrimination for exercising their consumer rights.

Information provided in response to a consumer request must be provided free of charge, up to twice annually per consumer. If requests from a consumer are manifestly unfounded, technically infeasible, excessive, or repetitive, then the controller may charge a reasonable fee to cover the administrative costs of complying with the request or decline to act on the request.

Additionally, a Controller shall establish a process for the consumer to appeal the Controller’s refusal to take action on a request. The appeal process must be made conspicuously available and at no cost to the consumer and similar to the process for submitting requests to initiate action. The Controller is required to take action within 60 days of receipt of an appeal and inform the consumer in writing of action taken or not taken in response to the appeal, including a written explanation of the reasons for the decisions, as well as provide a mechanism for them to contact the Attorney General if the appeal is denied.

More Details

Definitions:

• Affiliate: A legal entity that controls, is controlled by, or is under common control with another legal entity, or shares common branding with another legal entity. "Control" means ownership of, or the power to vote, more than fifty percent (50%) of a class of voting securities, control over the election of a majority of directors (or equivalent governing individuals), or the power to exercise a controlling influence over the company's management.
• Authenticate: Verify using reasonable means that a consumer who is entitled to exercise the rights in § 47-18-3304, is the same consumer who is exercising those consumer rights with respect to the personal information at issue.
• Biometric Data: Data generated by automatic measurement of an individual's biological characteristics (e.g., fingerprints, voiceprints, retina or iris scans, or other unique biological characteristics) used to identify a specific individual. It does not include photographs, video or audio recordings, data generated from those recordings, or information collected, used, or stored for HIPAA treatment, payment, or healthcare operations.
• Business Associate: Same meaning as under HIPAA.
• Child: Natural person younger than thirteen (13) years of age.
• Consent: Clear affirmative act signifying a consumer's freely given, specific, informed, and unambiguous agreement to process personal information, including a written statement (electronic or otherwise) or other unambiguous affirmative action.
• Consumer: An individual who is a Tennessee resident acting only in a personal context; this definition does not include individuals acting a commercial or employment context.
• Controller: A natural or legal person that, alone or jointly with others, determines the purposes and means for processing Personal Information.
• Covered Entity: Same meaning as under HIPAA
• Decisions that produce legal or similarly significant effects concerning the consumer: Decisions made by the controller that result in provision or denial by the controller of financial or lending services, housing, insurance, education enrollment or opportunity, criminal justice, employment opportunities, healthcare services, or access to basic necessities, such as food and water.
• De-Identified Data: Data that cannot reasonably be linked to an identified or identifiable individual or a device linked to that individual.
• Health Record: Written, printed, or electronic records created or maintained by a healthcare entity in providing healthcare services that concern the individual and the services provided, including confidential communications and information obtained in connection with those services.
• Personal Information: Information linked to or reasonably linkable to an identified or identifiable individual. Personal Information excludes: de-identified or aggregate consumer information and publicly available information.
• Precise Geolocation Data: Information derived from technology, including GPS coordinates or similar mechanisms, that directly identifies the location of a natural person within a radius of 1,750 feet. It does not include the content of communications or data generated by, or connected to, advanced utility metering infrastructure systems or equipment used by a utility.
• Processor: Natural or legal entity that processes personal information on behalf of a controller.
• Profiling: Any form of automated processing of Personal Information to evaluate, analyze, or predict personal aspects concerning an identified or identifiable individual’s economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.
• Protected Health Information: Same meaning as defined by HIPAA.
• Pseudonymous Data: Personal information that cannot be attributed to a specific natural person without additional information, provided the additional information is kept separately and protected by appropriate technical and organizational measures to prevent attribution to an identified or identifiable natural person.
• Publicly Available Information: Information lawfully made available through federal, state, or local government records, or information a business reasonably believes is lawfully made available to the general public through widely distributed media, by the consumer, or by a person to whom the consumer disclosed the information, unless the consumer restricted the information to a specific audience.
• Sale of Personal Information: The exchange of Personal Information for valuable monetary consideration by the Controller to a third party. The sale excludes the following disclosures from this definition: (i) disclosure to a processor for processing on behalf of the Controller; (ii) disclosures to a third party to provide a product or service requested by the Consumer; (iii) disclosures to an affiliate of the Controller; (iv) disclosures made by a Consumer to the general public via mass media (v) a disclosure or transfer as an asset in a merger or other transaction in which the third party assumes control of all or part of the Controller’s assets.
• Sensitive Personal Data: Personal Information revealing: racial or ethnic origin, religious beliefs, mental/physical health diagnosis, sexual orientation, or citizenship or immigration status; processing of genetic and biometric data for uniquely identifying a natural person; Personal Information collected from a known child or precise geolocation data.
• Targeted Advertising: Displaying to a consumer advertisement based on personal information obtained from consumer’s activities over time and across nonaffiliated websites or applications to predict their interests or preferences. Excludes: (i) advertisement based on activities within the Controllers websites; (ii) advertisement based on the context of consumers current search query or visit to a website/application; (iii) advertisement directed to the consumer in response to their request; or (iv) Personal Information Processed solely for measuring or reporting advertisement performance.
• Third Party: Natural or legal person, public authority, agency, or body other than the consumer, controller, processor, or an affiliate of the processor or the controller.
• Trade Secret: Information, in any form, including technical, nontechnical, or financial information, formulas, patterns, compilations, programs, devices, methods, techniques, plans, or processes, that (A) derives independent economic value from not being generally known or readily ascertainable by proper means, and (B) is subject to reasonable efforts to maintain its secrecy.

Penalties:

Violations of the TIPA constitute an unfair trade practice and may be enforced by the Attorney General and reporter, with a sixty (60) day cure period. The maximum civil penalty for violations is $7,500 per violation.

Private Action:

No

Associated Regulations:

N/A

Notes on AI Related Regulations:

Tennessee's AI-related regulations are currently sectoral and issue-specific, focusing on education, consumer protection (especially regarding deepfakes and likeness rights), and privacy in automated decision-making. Broader regulatory frameworks and additional rulemaking may be developed in the future, particularly as the advisory council continues its work and as TIPA is implemented.

• Tennessee Code, T.C.A. § 49-13-118, Artificial intelligence - Adoption and implementation of artificial intelligence policies. Tennessee requires the governing body of each public charter school to adopt and implement a policy regarding the use of artificial intelligence (AI) by students, teachers, and staff for instructional and assignment purposes.
• Tennessee has enacted laws addressing specific AI-related issues, including:
  • Chatbots: Statutes governing the use of chatbots.
  • Deepfakes of Minors: Laws prohibiting or regulating the creation and distribution of AI-generated deepfakes involving minors.
  • Ensuring Likeness Voice and Image Security (ELVIS) Act:  Protects against unauthorized use of a person's voice or image generated by AI.
  • Health Care Services: Statutes addressing AI use in health care
  • Sexual Deepfakes: Law prohibiting the creation or distribution of sexually explicit deepfakes

Effective Date:

July 1, 2025

Highlights

Covered Entities: Any person licensed, authorized to operate, or registered, or required to be licensed, authorized, or registered pursuant to the insurance laws of Tennessee  (a "Licensee") 

Security Standard: A Licensee must develop, implement, and maintain a comprehensive written information security program based on a risk assessment that contains administrative, technical, and physical safeguards for nonpublic information and the information systems.

Consumer Notification: Following a determination that a Cybersecurity Event (as defined below) has occurred that has a reasonable likelihood of materially harming a consumer, a Licensee shall notify consumers residing in Tennessee whose nonpublic information has been acquired, or reasonably believed to have been acquired, within 45 days unless a longer period of time is required due to the legitimate needs of law enforcement.

Regulatory Notification: A Licensee shall notify the Commissioner of Insurance as promptly as practicable, but in no event later than three business days following a determination that a Cybersecurity Event has occurred, if the criteria referenced elow are met.

Notification Timeline: Regulatory notification is due no later than three business days following a determination that a Cybersecurity Event has occurred. Consumer notification is due not later than 45 days after such a determination is made. 

Citations: T.C.A §§ 56-2-100 to 56-2-1011

More Details

Definitions:

• Consumer: An individual, including an applicant, policyholder, insured, beneficiary, claimant, or certificate holder, who is a resident of Tennessee and whose nonpublic information is in a Licensee's possession, custody, or control.
• Cybersecurity Event: An event resulting in unauthorized access to, disruption, or misuse of an information system or nonpublic information stored on an information system, except that a Cybersecurity Event does not include any of the following:
  
  • Unauthorized acquisition of encrypted nonpublic information if the encryption process or key is not also acquired, released, or used without authorization.
  • An event in which the Licensee determines that the nonpublic information accessed by an unauthorized person has not been used or released and has been returned or destroyed.
• Licensee: A person licensed, authorized to operate, or registered, or required to be licensed, authorized to operate, or registered under Tennessee insurance laws. This does not include a purchasing group or risk retention group chartered and licensed in another state or a Licensee acting as an assuming insurer where domiciled in another state / jurisdiction.
• Nonpublic Information: Information in the possession, custody, or control of a Licensee that is not publicly available information and is any of the following:
  
  • Business-related information of a Licensee, in which the tampering with, unauthorized disclosure of, access to, or use of, would cause a material adverse impact to the business, operations, or security of the Licensee;
  • Information concerning a consumer that can be used to identify the consumer, in combination with the following data elements:
    
    • Social Security number;
    • Driver’s license number or nondriver identification card number;
    • Financial account number or credit or debit card number;
    • Security code, access code, or password that would permit access to a consumer’s financial account; or
    • Biometric records.
  • Information or data, except a person's age or sex, created by or derived from a healthcare provider or a consumer that relates to:
    
    • The past, present, or future physical, mental, or behavioral health or health condition of a consumer or a member of a consumer's immediate family;
    • The provision of health care to a consumer; or
    • Payment for the provision of health care to a consumer;
• Person: An individual or non-governmental entity, including a sole proprietorship, corporation, limited liability company, partnership, trust, religious organization, associated, nonprofit organization, or another legal entity.

Consumer Notice:

A Licensee shall notify consumers residing in Tennessee whose nonpublic information has been acquired, or is reasonably believed to have been acquired, within 45 days after a determination that a Cybersecurity Event has occurred that has a reasonable likelihood of materially harming the consumer.

Consumer Notice Methods:

Consumer notice may be provided by written notice, electronic notice under specific circumstances, or substitute notice if the Licensee demonstrates that the cost of providing notice would exceed $250,000, the class to be notified exceeds 500,000 persons, or the licensee does not have sufficient contact information. 

Regulatory Notice:

A Licensee shall notify the Commissioner of Insurance as soon as practicable, no later than 3 business days following a determination that a Cybersecurity Event has occurred, if:

• The Licensee is domiciled in Tennessee, in the case of an insurer, as defined in § 56-6-102, or Tennessee is the Licensee's home state, in the case of an insurance producer, as defined in § 56-6-102; and
• The Cybersecurity Event has a reasonable likelihood of materially harming a consumer residing in Tennessee or a material part of the Licensee's normal operations; or

The Licensee reasonably believes that the nonpublic information of 250 or more consumers residing in Tennessee is involved in the Cybersecurity Event and that the Cybersecurity Event is:

• A Cybersecurity Event of which notice must be provided to a government body, self-regulatory agency, or other supervisory body pursuant to state or federal law; or
• A Cybersecurity Event with a reasonable likelihood of materially harming a consumer residing in Tennessee or a material part of the Licensee's normal operations.

Regulatory Notice Content Requirements:

A Licensee shall provide as much of the following information as possible to the Commissioner of Insurance:

• The date of the Cybersecurity Event;
• A description of how the nonpublic information was exposed, lost, stolen, or breached, including the specific roles and responsibilities of third-party service providers with respect to the nonpublic information, if any;
• How the Cybersecurity Event was discovered;
• Whether lost, stolen, or breached nonpublic information has been recovered and, if so, how recovery was accomplished;
• The identity of the source of the Cybersecurity Event;
• Whether the Licensee has filed a police report or notified regulatory, governmental, or law enforcement agencies and, if so, when the notification was provided;
• A description of the specific types of nonpublic information or particular data elements acquired without authorization, which may include types of medical information, types of financial information, or types of information allowing for consumer identification;
• The period during which the Licensee's information system was compromised by the Cybersecurity Event;
• The number of total consumers in this state affected by the Cybersecurity Event. The Licensee shall provide its best estimate of this number of consumers in its initial report to the commissioner and update this estimate with each subsequent report to the commissioner pursuant to this subsection (b);
• The results of an internal review and whether the review identified whether automated controls or internal procedures were followed or adhered to;
• A description of the efforts to remediate the situation that permitted the Cybersecurity Event to occur;
• A copy of the Licensee's privacy policy and a statement outlining the steps that the licensee will take to investigate which consumers were affected by the Cybersecurity Event and to notify affected consumers;
• The name of a person who is both knowledgeable regarding the Cybersecurity Event and authorized to act on behalf of the Licensee to serve as a representative of the Licensee for contact from the commissioner; and
• A copy of the notice sent to affected consumers, if the notice is required under subsection C.

The Licensee shall continually provide material updates or supplements to the information provided.

Third-Party Notice Requirements:

In the case of a Cybersecurity Event involving nonpublic information that is used by, or in the possession, custody, or control of a Licensee or  third-party service provider acting as an assuming insurer that does not have a direct relationship with affected consumer, the assuming insurer shall notify the affected ceding insurers and the Commissioner of the Licensee's state of domicile within 3 business days. The ceding insurers must fulfill the resulting consumer notification requirements.

Other:

In the case of a Cybersecurity Event involving nonpublic information in the possession, custody, or control of a Licensee that is an insurer, or the third-party service provider for which a consumer accessed the insurer’s services through an independent insurance producer, the insurer shall notify the producers of record of all affected consumers, if known, as soon as practicable, but not later than when such notice is provided to the affected consumers.

Penalties:

No private right of action. The Commissioner of Insurance may seek penalties under § 56-2-305, which may include payment of a monetary penalty of not more than $1,000 for each violation, not to exceed an aggregate penalty of $100,000, unless the insurer, person, or entity knowingly violates a statute, rule or order, in which case the penalty shall not be more than $25,000 for each violation, not to exceed an aggregate penalty of $250,000. This subdivision (a)(2) shall not apply where a statute or rule specifically provides for other civil penalties.

Associated Regulations:

N/A