---
title: "Texas privacy law (TDPSA): controller duties"
canonical: "https://dposchool.com/state-privacy-laws/state/texas/controller-duties"
source: "https://statutes.capitol.texas.gov/Docs/BC/htm/BC.541.htm"
text_as_of: "2026-10-28"
last_reviewed: "2026-10-29"
language: "en-US"
publisher: "DPO School"
---

Texas Data Privacy and Security Act

# Texas privacy law (TDPSA): controller duties

Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review)

## Summary (not the statute text)

Controllers must limit collection to what is adequate, relevant and reasonably necessary for disclosed purposes, keep reasonable security, and not process for incompatible purposes without consent. The privacy notice must list categories of data (including sensitive data), purposes, rights and appeals, data and recipients shared with, and the request methods. Data protection assessments are required for targeted advertising, sale, risky profiling, sensitive data and other heightened-risk processing; universal opt-out technologies used through an authorized agent must be honored from 1 January 2025.

## Key points

1. Data minimisation (adequate, relevant and reasonably necessary) and reasonable security.

   Section: [§ 541.101(a)](https://statutes.capitol.texas.gov/Docs/BC/htm/BC.541.htm)

2. Purpose limitation: consent for purposes neither reasonably necessary to nor compatible with disclosed purposes.

   Section: [§ 541.101(b)(1)](https://statutes.capitol.texas.gov/Docs/BC/htm/BC.541.htm)

3. Privacy notice contents.

   Section: [§ 541.102(a)](https://statutes.capitol.texas.gov/Docs/BC/htm/BC.541.htm)

4. Clear and conspicuous disclosure of sale and targeted advertising and how to opt out.

   Section: [§ 541.103](https://statutes.capitol.texas.gov/Docs/BC/htm/BC.541.htm)

5. Opt-out through an authorized agent's technology (browser setting or extension, global device setting) must be honored from 1 January 2025, with listed exceptions such as inability to verify Texas residency.

   Section: [§ 541.055(e), (f); H.B. 4, § 7(b)](https://statutes.capitol.texas.gov/Docs/BC/htm/BC.541.htm)

6. Data protection assessments for listed heightened-risk processing, for activities generated after 1 July 2024.

   Section: [§ 541.105(a); H.B. 4, § 4](https://statutes.capitol.texas.gov/Docs/BC/htm/BC.541.htm)

7. No discrimination for exercising rights; bona fide loyalty programs allowed.

   Section: [§ 541.101(b)(3), (c)](https://statutes.capitol.texas.gov/Docs/BC/htm/BC.541.htm)

## Sources

- [https://statutes.capitol.texas.gov/Docs/BC/htm/BC.541.htm](https://statutes.capitol.texas.gov/Docs/BC/htm/BC.541.htm)
- [H.B. 4, 88th Legislature, enrolled text](https://capitol.texas.gov/tlodocs/88R/billtext/html/HB00004F.htm)

[Compare controller duties across all states](https://dposchool.com/state-privacy-laws/topic/controller-duties)

## Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

- [Article 35: Data protection impact assessment](https://dposchool.com/gdpr/article/35) (assessments)

## Status

Law as of October 28, 2026.

[Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed.

[Official text of the Texas statute](https://statutes.capitol.texas.gov/Docs/BC/htm/BC.541.htm)

Reference material, not legal advice.

## Other topics for Texas

- [Applicability](https://dposchool.com/state-privacy-laws/state/texas/applicability)
- [Consumer rights](https://dposchool.com/state-privacy-laws/state/texas/consumer-rights)
- [Sensitive data](https://dposchool.com/state-privacy-laws/state/texas/sensitive-data)
- [Processors](https://dposchool.com/state-privacy-laws/state/texas/processors)
- [Enforcement](https://dposchool.com/state-privacy-laws/state/texas/enforcement)

## Navigation

[US State Privacy Laws](https://dposchool.com/state-privacy-laws) / [Texas](https://dposchool.com/state-privacy-laws/state/texas) / Controller duties

Previous: [Sensitive data](https://dposchool.com/state-privacy-laws/state/texas/sensitive-data)

Next: [Processors](https://dposchool.com/state-privacy-laws/state/texas/processors)

Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com).

## For AI agents

- Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt
- JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents