Bill > HB1033

This bill establishes a new legal framework for data security in Tennessee that provides businesses (called "covered entities") with an affirmative defense against data breach lawsuits if they maintain a robust cybersecurity program. The bill defines key terms like "data breach" (an act that could potentially expose electronic information in a way that risks fraud or identity theft) and requires covered entities to create and maintain a written cybersecurity program with administrative, technical, operational, and physical safeguards to protect personal, health, and restricted information. To qualify for the affirmative defense, entities must have a cybersecurity program that conforms to recognized industry frameworks such as NIST standards, ISO standards, or specific federal regulations like HIPAA, and must have a designated chief information security officer who trains employees on safety practices. The program must proactively protect against security threats, continuously evaluate risks, and communicate potential breaches to affected parties. Importantly, the bill does not create a private right of action, meaning individuals cannot directly sue under this law, but it provides businesses a potential legal shield if they can demonstrate they had comprehensive security measures in place at the time of a data breach. The law will take effect on July 1, 2025.

Justice

https://wapp.capitol.tn.gov/apps/Billinfo/default.aspx?BillNumber=HB1033&ga=114