---
title: "Texas privacy law (TDPSA): applicability"
canonical: "https://dposchool.com/state-privacy-laws/state/texas/applicability"
source: "https://statutes.capitol.texas.gov/Docs/BC/htm/BC.541.htm"
text_as_of: "2026-10-28"
last_reviewed: "2026-10-29"
language: "en-US"
publisher: "DPO School"
---

Texas Data Privacy and Security Act

# Texas privacy law (TDPSA): applicability

Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review)

## Summary (not the statute text)

The act applies to any person that does business in Texas or produces a product or service consumed by residents, processes or sells personal data, and is not a small business as defined by the U.S. Small Business Administration. There is no consumer-volume or revenue threshold. Small businesses remain bound by one rule: they may not sell sensitive data without prior consent. State agencies, financial institutions or data subject to GLBA Title V, HIPAA covered entities and business associates, nonprofits, higher education and certain electricity companies are exempt.

## Key points

1. Applies to persons doing business in Texas or producing products or services consumed by residents that process or sell personal data.

   Section: [§ 541.002(a)(1), (2)](https://statutes.capitol.texas.gov/Docs/BC/htm/BC.541.htm)

2. Small businesses as defined by the SBA are excluded, except for the sensitive-data sale rule in § 541.107.

   Section: [§ 541.002(a)(3); § 541.107](https://statutes.capitol.texas.gov/Docs/BC/htm/BC.541.htm)

3. No consumer-count or revenue threshold.

   Section: [§ 541.002(a)](https://statutes.capitol.texas.gov/Docs/BC/htm/BC.541.htm)

4. Entity exemptions: state agencies and political subdivisions, financial institutions or data subject to GLBA Title V, HIPAA covered entities and business associates, nonprofits, higher education, and electric utilities, power generators and retail electric providers.

   Section: [§ 541.002(b)](https://statutes.capitol.texas.gov/Docs/BC/htm/BC.541.htm)

5. Data exemptions include PHI, health records, research data, FCRA activity, DPPA, FERPA and Farm Credit Act data.

   Section: [§ 541.003(1) to (14)](https://statutes.capitol.texas.gov/Docs/BC/htm/BC.541.htm)

6. Employee, applicant and contractor data and people acting in a commercial or employment context are outside the act.

   Section: [§ 541.001(7); § 541.003(15) to (17)](https://statutes.capitol.texas.gov/Docs/BC/htm/BC.541.htm)

## Sources

- [https://statutes.capitol.texas.gov/Docs/BC/htm/BC.541.htm](https://statutes.capitol.texas.gov/Docs/BC/htm/BC.541.htm)

[Compare applicability across all states](https://dposchool.com/state-privacy-laws/topic/applicability)

## Status

Law as of October 28, 2026.

[Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed.

[Official text of the Texas statute](https://statutes.capitol.texas.gov/Docs/BC/htm/BC.541.htm)

Reference material, not legal advice.

## Other topics for Texas

- [Consumer rights](https://dposchool.com/state-privacy-laws/state/texas/consumer-rights)
- [Sensitive data](https://dposchool.com/state-privacy-laws/state/texas/sensitive-data)
- [Controller duties](https://dposchool.com/state-privacy-laws/state/texas/controller-duties)
- [Processors](https://dposchool.com/state-privacy-laws/state/texas/processors)
- [Enforcement](https://dposchool.com/state-privacy-laws/state/texas/enforcement)

## Navigation

[US State Privacy Laws](https://dposchool.com/state-privacy-laws) / [Texas](https://dposchool.com/state-privacy-laws/state/texas) / Applicability

Next: [Consumer rights](https://dposchool.com/state-privacy-laws/state/texas/consumer-rights)

Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com).

## For AI agents

- Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt
- JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents