Data breach notification
Tennessee's rule is Tenn. Code Ann. § 47-18-2107, part of the Identity Theft Deterrence Act, in the form rewritten by 2017 Public Chapter 91.
This page reads that 2017 public chapter, published as a scan on the Tennessee Secretary of State's site, because the state does not publish the current code online in an official text.
Public Chapter 91 amended § 47-18-2107 "by deleting the section and substituting instead the following", so it carries the whole section as it stood after 2017.
Amendments made after 2017 were not checked. Everything below describes the 2017 text.
"The disclosure must be made no later than forty-five (45) days from the discovery or notification of the breach of system security, unless a longer period of time is required due to the legitimate needs of law enforcement."
So the clock can run from either moment: the holder finding the breach itself, or being told about it.
The 2017 text names no attorney general or other regulator to be told.
Personal information is a first name or first initial and last name with one of three elements:
A breach covers "Unencrypted computerized data" and "Encrypted computerized data and the encryption key". Encrypted data taken without its key falls outside the definition.
The 2017 text has no risk-of-harm exception, so the duty does not depend on a finding about likely misuse.
Nashville and Memphis businesses that exchange bank details or license scans with partners usually find, after an incident, that email threads give no clear answer to who saw them.
For documents you share through ShareAndGo, the activity log records every view and download, and watermarked view-only pages carry the reader's email address and the date.
Watermarking is a per-room setting, on by default. Recipients confirm their email with a six-digit code and need no account, groups see only their own folders, and the chained activity log exports as CSV.
The text read is 2017 Public Chapter 91 (SB 547), a scanned PDF on the Tennessee Secretary of State's publications site.
Checked against Tennessee's 2017 public chapter on November 2, 2026. This is general information, not legal advice.
