Breach Notification 1Who you must tell after a data breach, and how fast
LawProduceWhat it requiresTriggerEnforced by
Release of personal consumer information (data breach notification)AI-compiledTenn. Code Ann. § 47-18-2107, as rewritten by Public Chapter 91 of 2017 (SB 547)Any person, business or state agency doing business in Tennessee that owns or licenses computerized personal information about Tennessee residents; entities covered by Gramm-Leach-Bliley or HIPAA are excludedDistribute + ack
Notice
Tell every affected Tennessee resident about a breach no later than 45 days after discovery, by written, electronic or (above the cost and volume limits) substitute notice. If more than 1,000 people are notified at once, also tell the nationwide consumer reporting agencies the timing, distribution and content of the notices. A business that already maintains its own breach notification procedure inside a written information security policy may follow that policy instead, so long as it meets the 45-day clock.
From the first employee
Private civil action by injured customers; Attorney General under the Consumer Protection Act
Consumer Privacy Law 1Rights, notices and assessments for consumer data
LawProduceWhat it requiresTriggerEnforced by
Tennessee Information Protection Act (TIPA)AI-compiledTenn. Code Ann. §§ 47-18-3201 to 47-18-3213 (Public Chapter 408 of 2023, HB 1181)Businesses doing business in Tennessee or targeting Tennessee residents that exceed $25 million in revenue AND either control or process personal information of 25,000+ consumers while drawing over half their gross revenue from selling personal information, or control or process personal information of 175,000+ consumers in a yearWrite
Written policy
Publish a privacy notice listing the categories of personal information processed, why it is processed, the categories sold and to whom, how to exercise consumer rights, and how to appeal a refused request. Document a data protection assessment for targeted advertising, data sales, risky profiling, sensitive data and other heightened-risk processing. Get consent before processing sensitive data, run an appeals process, and put a written contract in place with every processor. A written privacy program that reasonably conforms to the NIST Privacy Framework is an affirmative defense.
From the first employee
Tennessee Attorney General and Reporter (exclusive; 60-day cure period, civil investigative demands)
Workplace Safety Programs 1Written programs the state safety agency requires beyond federal OSHA
LawProduceWhat it requiresTriggerEnforced by
Tennessee Occupational Safety and Health Act (TOSHA State Plan)AI-compiledTenn. Code Ann. title 50, chapter 3; Rules of the Department of Labor and Workforce Development 0800-01-01 through 0800-01-11All private-sector and state and local government employers in TennesseeWrite
Written program
Follow the TOSHA general industry, construction and agriculture standards, display the TOSHA Safety and Health poster, keep the OSHA 300 log and related injury and illness records and file the electronic submission where required, and report a workplace fatality within 8 hours and an in-patient hospitalization, amputation or loss of an eye within 24 hours. Tennessee does not impose a general written safety program beyond the federal-equivalent standards, though written programs are required by individual standards such as hazard communication and lockout/tagout.
From the first employee
Tennessee Occupational Safety and Health Administration, Department of Labor and Workforce Development
Insurance Data Security 1The written security program insurance licensees must certify
LawProduceWhat it requiresTriggerEnforced by
Tennessee Insurance Data Security LawAI-compiledTenn. Code Ann. §§ 56-2-1001 to 56-2-1011Insurance licensees of the Department of Commerce and Insurance; licensees with fewer than 25 employees, under $5 million in gross annual revenue or under $10 million in year-end total assets are exempt, as are firms certifying compliance with Gramm-Leach-Bliley Title VCertify
Certification
Build a written information security program from a risk assessment and keep it current. Insurers domiciled in Tennessee file a written certification of compliance with the Commissioner by April 15 each year and keep the supporting records and remediation documentation for five years. Exempt licensees file a written exemption certification instead. Report cybersecurity events to the Commissioner through the department's online system.
25+ employees
Tennessee Department of Commerce and Insurance
Required Postings 1The notices every workplace in the state must display
LawProduceWhat it requiresTriggerEnforced by
Required state workplace postersAI-compiledTenn. Code Ann. title 50 (wage, child labor, workers' compensation, unemployment and occupational safety provisions)Tennessee employers; the department advises that employers with two or more employees, including non-profits and family businesses, must display the state and federal setPost
Posting
Display the four required state posters (TOSHA Safety and Health, Unemployment Insurance, Wage Regulation/Child Labor, and the Workers' Compensation Posting Notice) plus the federal set, in a place employees use such as a break room or time-clock area. The department supplies them free and warns employers never to pay a vendor for them. The Right to Work, Drug-Free Workplace and human trafficking hotline posters are recommended, not required.
From the first employee
Tennessee Department of Labor and Workforce Development
Licensing and Certifications 4Registrations, licences and certifications a business or its staff must hold
LawProduceWhat it requiresTriggerEnforced by
Business entity registration and annual reportAI-compiledTenn. Code Ann. title 48 (corporations and LLCs); title 61 (partnerships)Any corporation, LLC, limited partnership or nonprofit formed in or doing business in TennesseeFile
Filing / record
File formation or foreign qualification documents with the Secretary of State, name a registered agent, and file an annual report through the TNCaB business account to stay in good standing. The office warns businesses that third-party solicitors send look-alike renewal notices.
From the first employee
Tennessee Secretary of State, Division of Business and Charitable Organizations
Business tax registration and minimal activity licenseAI-compiledTenn. Code Ann. title 67, chapter 4, part 7Businesses selling goods or services in a Tennessee county or municipality with gross receipts of $100,000 or more, plus out-of-state sellers with substantial nexusFile
Filing / record
Register with the Department of Revenue for the state business tax, obtain a city business license where the municipality has enacted the tax, file and pay the annual business tax return, and file a final return within 15 days of closing the business.
From the first employee
Tennessee Department of Revenue and local county and city clerks
Contractor, home improvement contractor and limited licensed trades licensingAI-compiledTenn. Code Ann. title 62, chapter 6; Rules of the Board for Licensing Contractors 0680-01General contractors, home improvement contractors, limited licensed electricians and limited licensed plumbers working in TennesseeFile
Filing / record
Hold a license from the Board for Licensing Contractors before bidding or contracting, name a qualifying agent who has passed the business/law and trade exams, and back the requested monetary limit with either a CPA-reviewed or audited financial statement or, since July 1, 2026, the Board's surety bond at 50% of the monetary limit. Licenses are renewed on the Board's cycle.
From the first employee
Tennessee Board for Licensing Contractors, Department of Commerce and Insurance
Food service establishment permit (Tennessee Food Safety Act)AI-compiledTenn. Code Ann. title 68, chapter 14, part 7; Rules of the Department of Health 1200-23-01Restaurants, cafes, food trucks, caterers and other places preparing and serving food to the publicFile
Filing / record
Apply to the Department of Health on the commissioner's form and pay the permit fee before opening, pass Environmental Health inspections carried out through local health departments, and designate a person in charge who can demonstrate foodborne illness prevention knowledge, which a certified food protection manager credential from an accredited program satisfies.
From the first employee
Tennessee Department of Health, Environmental Health Program
Other Written Policies 5Any other document the state makes an employer write or hand out
LawProduceWhat it requiresTriggerEnforced by
Tennessee Lawful Employment Act (employment authorization records / E-Verify)AI-compiledTenn. Code Ann. §§ 50-1-701 to 50-1-712Private employers with six or more employees; employers with 35 or more full-time equivalent employees under one FEIN must use E-Verify, and from January 1, 2027 the act reaches employers with at least one employeeFile
Filing / record
Either run every new hire through federal E-Verify and keep the case results, or request and keep a copy of one of the state's listed identity and work authorization documents before the person starts work. Social security cards and I-9 forms do not count. The same documentation duty covers non-employees paid directly for labor or services. Records must be produced on request during a Labor Standards investigation.
6+ employees
Tennessee Department of Labor and Workforce Development, Labor Standards Unit
Tennessee Non-Smoker Protection ActAI-compiledTenn. Code Ann. §§ 39-17-1801 to 39-17-1812Owners and operators of enclosed public places and places of employment; limited exemptions include venues restricted to patrons 21 and over, private clubs, hotel smoking rooms and non-enclosed areasPost
Posting
Post 'No Smoking' signs or the international no-smoking symbol at every entrance to a public place or workplace where smoking is banned, tell every existing and prospective employee in writing that smoking is prohibited, and tell any patron found smoking to stop. Penalties escalate from a written warning to $100 and then $500 for repeat violations within twelve months.
From the first employee
Tennessee Department of Health and Tennessee Department of Labor and Workforce Development (Labor Standards Unit), by venue type
Drug-Free Workplace Program (voluntary certification)AI-compiledTenn. Code Ann. title 50, chapter 9; Rule 0800-02-12Any Tennessee employer that chooses to join; participation is optional, not mandatoryCertify
Certification
Adopt a written drug and alcohol policy statement and give it to employees and job applicants before any testing, apply to the Bureau of Workers' Compensation with the policy attached, and renew the application each year with the workers' compensation policy. Certified participants get a 5% workers' compensation premium credit and a shifted burden of proof when an injured employee later fails a post-accident test.
From the first employee
Tennessee Bureau of Workers' Compensation, Department of Labor and Workforce Development
Tennessee Pregnant Workers Fairness ActAI-compiledTenn. Code Ann. §§ 50-10-101 to 50-10-104 (Public Chapter 745 of 2020, SB 2520)Employers with 15 or more employeesWrite
Written policy
Run a good-faith interactive process and provide reasonable accommodations for medical needs arising from pregnancy, childbirth or related conditions unless doing so is an undue hardship, including a private non-bathroom space for expressing milk. Employers may not force leave when another accommodation would work, or count pregnancy-related absences under a no-fault attendance policy. Medical certification may be requested only if it is requested of other employees. The act does not add a poster or a filing.
15+ employees
Commissioner of Labor and Workforce Development; private civil action in chancery or circuit court
Child Labor Act (records for minor employees)AI-compiledTenn. Code Ann. title 50, chapter 5Any employer of minors aged 14 to 17File + ack
Filing / record
Keep the signed parental consent form in the minor's personnel file at the work location if 16- and 17-year-olds are to work past 10:00 pm on a school night, keep the school director's letter for church-school and home-schooled students, observe the daily and weekly hour limits, give a 30-minute unpaid break after six consecutive hours, and post the Wage Regulation/Child Labor poster. Where state and federal child labor rules differ, the stricter one applies.
From the first employee
Tennessee Department of Labor and Workforce Development, Labor Standards Unit