DPO SchoolDPO School

Texas Data Privacy and Security Act

Texas privacy law (TDPSA): controller duties

Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026

Summary (not the statute text)

Controllers must limit collection to what is adequate, relevant and reasonably necessary for disclosed purposes, keep reasonable security, and not process for incompatible purposes without consent. The privacy notice must list categories of data (including sensitive data), purposes, rights and appeals, data and recipients shared with, and the request methods. Data protection assessments are required for targeted advertising, sale, risky profiling, sensitive data and other heightened-risk processing; universal opt-out technologies used through an authorized agent must be honored from 1 January 2025.

Key points

  1. Data minimisation (adequate, relevant and reasonably necessary) and reasonable security.

    Section: § 541.101(a)

  2. Purpose limitation: consent for purposes neither reasonably necessary to nor compatible with disclosed purposes.

    Section: § 541.101(b)(1)

  3. Privacy notice contents.

    Section: § 541.102(a)

  4. Clear and conspicuous disclosure of sale and targeted advertising and how to opt out.

    Section: § 541.103

  5. Opt-out through an authorized agent's technology (browser setting or extension, global device setting) must be honored from 1 January 2025, with listed exceptions such as inability to verify Texas residency.

    Section: § 541.055(e), (f); H.B. 4, § 7(b)

  6. Data protection assessments for listed heightened-risk processing, for activities generated after 1 July 2024.

    Section: § 541.105(a); H.B. 4, § 4

  7. No discrimination for exercising rights; bona fide loyalty programs allowed.

    Section: § 541.101(b)(3), (c)

Sources

Compare controller duties across all states

Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

Law as of October 28, 2026.

Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.

Official text of the Texas statute

Reference material, not legal advice.