{"type":"state-law","id":"TX","slug":"texas","name":"Texas","category":"comprehensive","lawName":"Texas Data Privacy and Security Act","citation":"Tex. Bus. & Com. Code §§ 541.001 to 541.205","officialUrl":"https://statutes.capitol.texas.gov/Docs/BC/htm/BC.541.htm","enacted":"2023-06-18","inForce":"2024-07-01","url":"https://dposchool.com/state-privacy-laws/state/texas","json":"https://dposchool.com/state-privacy-laws/api/v1/states/tx.json","law":{"id":"TX","name":"Texas","category":"comprehensive","lawName":"Texas Data Privacy and Security Act","citation":"Tex. Bus. & Com. Code §§ 541.001 to 541.205","officialUrl":"https://statutes.capitol.texas.gov/Docs/BC/htm/BC.541.htm","enacted":{"date":"2023-06-18","act":"Acts 2023, 88th Leg., R.S., ch. 995 (H.B. 4)","url":"https://capitol.texas.gov/tlodocs/88R/billtext/html/HB00004F.htm"},"effective":[{"date":"2024-07-01","what":"main provisions (H.B. 4, § 7(a)); data protection assessments apply only to processing activities generated after this date (H.B. 4, § 4)"},{"date":"2025-01-01","what":"authorized-agent opt-out technology (universal opt-out signals) must be honored (§ 541.055(e); H.B. 4, § 7(b))"},{"date":"2026-01-01","what":"H.B. 149 amendment to processor duties (artificial intelligence systems) in force"}],"amendments":[{"act":"Acts 2025, 89th Leg., R.S., ch. 1174 (H.B. 149), § 3","inForce":"2026-01-01","what":"Processors must also help controllers with the security of personal data collected, stored and processed by an artificial intelligence system (as defined in § 551.001).","url":"https://capitol.texas.gov/BillLookup/History.aspx?LegSess=89R&Bill=HB149"}],"pendingAmendments":[],"enforcer":"Attorney General (exclusive)","privateRight":{"value":false,"scope":"The chapter provides no basis for a private right of action (§ 541.156)."},"curePeriod":{"days":30,"sunset":false,"sunsetDate":null,"section":"§ 541.154","note":"Before suing, the Attorney General must give 30 days' written notice. No action may be brought if the person cures within 30 days and gives a written statement of cure, consumer notice where possible, supporting documents and policy changes. The cure period has no end date. Breaching the written statement exposes the person to penalties (§ 541.155(a))."},"rulemaking":{"value":false,"agency":null,"url":null,"note":"The chapter grants no rulemaking power. The Attorney General must post guidance and a complaint mechanism (§ 541.152)."},"lastVerified":"2026-10-28","sources":[{"title":"Texas Business and Commerce Code, chapter 541 (official statutes site, served from the Texas Legislative Council resources host)","url":"https://tcss.legis.texas.gov/resources/BC/htm/BC.541.htm","kind":"statute","read":"2026-10-28"},{"title":"H.B. 4, 88th Legislature, enrolled text","url":"https://capitol.texas.gov/tlodocs/88R/billtext/html/HB00004F.htm","kind":"session-law","read":"2026-10-28"},{"title":"H.B. 4, 88th Legislature, bill history (signed 18 June 2023)","url":"https://capitol.texas.gov/BillLookup/History.aspx?LegSess=88R&Bill=HB4","kind":"session-law","read":"2026-10-28"},{"title":"H.B. 149, 89th Legislature, bill history (effective 1 January 2026)","url":"https://capitol.texas.gov/BillLookup/History.aspx?LegSess=89R&Bill=HB149","kind":"session-law","read":"2026-10-28"}]},"topics":[{"id":"applicability","name":"Applicability","summary":"The act applies to any person that does business in Texas or produces a product or service consumed by residents, processes or sells personal data, and is not a small business as defined by the U.S. Small Business Administration. There is no consumer-volume or revenue threshold. Small businesses remain bound by one rule: they may not sell sensitive data without prior consent. State agencies, financial institutions or data subject to GLBA Title V, HIPAA covered entities and business associates, nonprofits, higher education and certain electricity companies are exempt.","url":"https://dposchool.com/state-privacy-laws/state/texas/applicability","json":"https://dposchool.com/state-privacy-laws/api/v1/states/tx/applicability.json"},{"id":"consumer-rights","name":"Consumer rights","summary":"Consumers may confirm and access, correct, delete data provided by or obtained about them, obtain a portable copy of data they provided, and opt out of targeted advertising, sale and significant profiling. Controllers answer within 45 days, extendable once by 45 days, and must answer free of charge at least twice a year per consumer. Appeals must be decided within 60 days, with a link to the Attorney General's complaint mechanism on denial.","url":"https://dposchool.com/state-privacy-laws/state/texas/consumer-rights","json":"https://dposchool.com/state-privacy-laws/api/v1/states/tx/consumer-rights.json"},{"id":"sensitive-data","name":"Sensitive data","summary":"Sensitive data covers racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexuality, citizenship or immigration status, identifying genetic or biometric data, data from a known child under 13, and precise geolocation within 1,750 feet. Controllers need consent to process it, and must follow COPPA for a known child. Controllers that sell sensitive or biometric data must post a set notice, and even exempt small businesses need prior consent to sell sensitive data.","url":"https://dposchool.com/state-privacy-laws/state/texas/sensitive-data","json":"https://dposchool.com/state-privacy-laws/api/v1/states/tx/sensitive-data.json"},{"id":"controller-duties","name":"Controller duties","summary":"Controllers must limit collection to what is adequate, relevant and reasonably necessary for disclosed purposes, keep reasonable security, and not process for incompatible purposes without consent. The privacy notice must list categories of data (including sensitive data), purposes, rights and appeals, data and recipients shared with, and the request methods. Data protection assessments are required for targeted advertising, sale, risky profiling, sensitive data and other heightened-risk processing; universal opt-out technologies used through an authorized agent must be honored from 1 January 2025.","url":"https://dposchool.com/state-privacy-laws/state/texas/controller-duties","json":"https://dposchool.com/state-privacy-laws/api/v1/states/tx/controller-duties.json"},{"id":"processors","name":"Processors","summary":"Processors must follow instructions and help with consumer requests, security (including, since 1 January 2026, data processed by an artificial intelligence system), breach notice and assessments. The contract must set out instructions, nature and purpose, data types, duration and the parties' rights and obligations. It must require confidentiality, deletion or return, compliance information, cooperation with assessments (or an independent assessor's report) and written flow-down to subcontractors.","url":"https://dposchool.com/state-privacy-laws/state/texas/processors","json":"https://dposchool.com/state-privacy-laws/api/v1/states/tx/processors.json"},{"id":"enforcement","name":"Enforcement","summary":"The Attorney General has exclusive enforcement authority and may issue civil investigative demands, including for data protection assessments. Before suing, the Attorney General must allow a 30-day cure period, which has no end date. Violations after the cure period, or breach of the written cure statement, carry a civil penalty of up to $7,500 per violation plus injunctions and fees; there is no private right of action.","url":"https://dposchool.com/state-privacy-laws/state/texas/enforcement","json":"https://dposchool.com/state-privacy-laws/api/v1/states/tx/enforcement.json"}],"lawAsOf":"2026-10-28","review":{"status":"reviewed","reviewedBy":{"name":"Sergio Maldonado Elvira","title":"Principal Attorney","url":"https://northend.law/leadership"},"lastReviewed":"2026-10-29","note":"Prepared from the official legislature and agency sources listed. Reviewed by Sergio Maldonado Elvira on 29 October 2026.","about":"https://dposchool.com/state-privacy-laws/about#review"},"disclaimer":"Reference material, not legal advice. Verify against the official text of each statute."}