This Law Firm Publication by Jackson Lewis P.C. addresses an amendment to Tennessee's breach notification statute. Under the amendment, Tennessee becomes one of the only states to set a specific time period by which an affected resident must be notified of a data breach. Tennessee's requirement that notification be provided within 45 days after the breach's discovery differs from other states that require notification in the most expedient time possible. In addition, the amendment extends the notification requirement to cover subject matter beyond breaches of unencrypted personal information. The new law also specifies that an "unauthorized person" includes an employee of the information holder who is discovered to have intentionally used personal information for an unlawful purpose.