Texas. Comprehensive data protection. Act

TDPSATexas Data Privacy and Security Act (Tex. Bus. & Com. Code ch. 541)

In force

Partly verified

Medium confidence. Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.

§1Summary

Synopsis

Virginia-style rights and duties applying to most businesses operating in Texas other than SBA-defined small businesses. The AG has been an active enforcer.

Key themes

consumer rights (access, deletion, correction, portability)
opt-out of sale, targeted advertising and profiling
sensitive data consent
data protection assessments
processor contracts
universal opt-out

Unique features

No numeric volume threshold; small businesses are exempt but still need consent before selling sensitive data; permanent 30-day cure.

SaaS relevance

Any non-small SaaS business processing Texas residents' data is in scope.

§2Obligations

Extraterritorial: Yes
Breach notification: See Tex. Bus. & Com. Code § 521.053 (separate statute)
DPO: No
Cross-border transfers: None
Maximum penalty: Up to $7,500 per violation

§3Dates

Key dates

Adopted 18 June 2023
In force 1 July 2024

§4Text and authority

Text

Authoritative text capitol.texas.gov

Authority

Texas Attorney General

§5Where it applies

Domestic law of: Texas

§6Sources and verification

Sources consulted

capitol.texas.gov

Verification

Medium confidence.

Partly verified

Medium confidence. Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.