Insurance Data Security Law

Tennessee's version of the NAIC Insurance Data Security Model Law. Insurance licensees must run a risk-based written information security program, oversee third-party service providers, investigate cybersecurity events, notify the Commissioner within three business days of qualifying events, and notify affected Tennessee consumers within 45 days when an event is reasonably likely to cause them material harm.