Tennessee data breach notification law (Release of personal consumer information)

Requires businesses and government bodies holding computerized personal information of Tennesseans to notify affected residents no later than 45 days after discovering a breach, with a law-enforcement delay. Personal information means name plus SSN, driver license number, or a financial account or card number with its access code. Encrypted data (FIPS 140-2) is covered only if the key is also taken, and large breaches must also be reported to the nationwide credit bureaus.