Texas Data Privacy and Security Act
Texas privacy law (TDPSA): applicability
Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026
Summary (not the statute text)
The act applies to any person that does business in Texas or produces a product or service consumed by residents, processes or sells personal data, and is not a small business as defined by the U.S. Small Business Administration. There is no consumer-volume or revenue threshold. Small businesses remain bound by one rule: they may not sell sensitive data without prior consent. State agencies, financial institutions or data subject to GLBA Title V, HIPAA covered entities and business associates, nonprofits, higher education and certain electricity companies are exempt.
Key points
Applies to persons doing business in Texas or producing products or services consumed by residents that process or sell personal data.
Section: § 541.002(a)(1), (2)
Small businesses as defined by the SBA are excluded, except for the sensitive-data sale rule in § 541.107.
Section: § 541.002(a)(3); § 541.107
No consumer-count or revenue threshold.
Section: § 541.002(a)
Entity exemptions: state agencies and political subdivisions, financial institutions or data subject to GLBA Title V, HIPAA covered entities and business associates, nonprofits, higher education, and electric utilities, power generators and retail electric providers.
Section: § 541.002(b)
Data exemptions include PHI, health records, research data, FCRA activity, DPPA, FERPA and Farm Credit Act data.
Section: § 541.003(1) to (14)
Employee, applicant and contractor data and people acting in a commercial or employment context are outside the act.
Section: § 541.001(7); § 541.003(15) to (17)
Sources
Compare applicability across all states
Law as of October 28, 2026.
Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.
Official text of the Texas statute
Reference material, not legal advice.