Texas. Breach notification. Act
TX breach lawTexas data breach notification law (Tex. Bus. & Com. Code §§ 521.002, 521.053, 521.151)
§1Summary
- Synopsis
Requires businesses (and in most cases public bodies) that own or license computerised personal information about Texas residents to notify affected individuals after a security breach. Core timing rule: Individuals within 60 days of determination. Covered data: name plus SSN, driver's/government ID, financial account with codes; health and healthcare payment information.
- Key themes
- Unique features
Applies to residents of other states too (or their state's law); AG publishes reported breaches; AG notice must be by online form.
- SaaS relevance
A SaaS provider hosting customer data is usually the 'maintaining' entity, not the owner: Texas requires the maintaining entity to notify the owner immediately after discovery. The owner customer then carries the individual and regulator notices, so contracts should fix timelines and cooperation.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- Individuals within 60 days of determination; AG via online form within 30 days if >=250 residents; CRAs if >10,000
- DPO
- No
- Cross-border transfers
- None
- Maximum penalty
- $2,000-$50,000 per violation; up to $100 per individual per day for late notice, capped at $250,000 per breach
§3Dates
- Key dates
- Adopted
- In force
- SB 768 (2023, eff. 2023-09-01) shortened AG notice to 30 days; HB 3746 (2021) online posting of breaches
§4Text and authority
- Text
- Authoritative text statutes.capitol.texas.gov
- Authority
- Texas Attorney General
§5Where it applies
- Domestic law of
- Texas
§6Sources and verification
- Sources consulted
- Verification
High confidence.
2025 session changes not verified (search budget exhausted).