Civil Procedure - As introduced, creates an affirmative defense that may be utilized by a covered entity that is the subject of a data breach, if the covered entity’s cybersecurity program meets certain criteria at the time the breach occurs. - Amends TCA Title 20; Title 29 and Title 47, Chapter 18.

SB 1421 creates an affirmative defense for businesses that experience data breaches if they maintained a written cybersecurity program meeting industry-recognized standards at the time of the breach. It applies to "covered entities" (businesses handling personal information, health data, or sensitive restricted information) and requires written security protocols based on frameworks like NIST, annual risk assessments, and employee training. Businesses using this defense must prove their program met these criteria when the breach occurred. This defense applies only to lawsuits alleging inadequate security controls, not to breaches resulting from known threats the business ignored.