Tennessee Adds New Encryption And Timing Requirements To Its Data Breach Notification Law

On April 4, 2017, Tennessee Governor Bill Haslam signed into law an amendment to the state's data breach notification law, making two substantive changes to the statute:

1. Adding a technically specific safe harbor encryption provision; and
2. Adding a 45 day window to complete breach notification, when required.

Overall Summary of Breach Notification Law

Tennessee's data breach notification law applies to any person or business conducting business in Tennessee that owns or licenses computerized data that contains "personal information." "Personal information" is defined under the statute as a person's first name or initial and last name combined with:

• Social security number;