Texas Data Privacy and Security Act
Texas privacy law (TDPSA): enforcement
Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026
Summary (not the statute text)
The Attorney General has exclusive enforcement authority and may issue civil investigative demands, including for data protection assessments. Before suing, the Attorney General must allow a 30-day cure period, which has no end date. Violations after the cure period, or breach of the written cure statement, carry a civil penalty of up to $7,500 per violation plus injunctions and fees; there is no private right of action.
Key points
Attorney General has exclusive authority.
Section: § 541.151
Civil investigative demands, including for relevant data protection assessments.
Section: § 541.153
30-day notice and cure, with a written statement of cure; no sunset.
Section: § 541.154
Civil penalty up to $7,500 per violation, injunction, and recovery of fees and expenses.
Section: § 541.155
No private right of action.
Section: § 541.156
The chapter preempts local ordinances on the same subject.
Section: § 541.205
Sources
Compare enforcement across all states
Related GDPR articles
Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.
Law as of October 28, 2026.
Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.
Official text of the Texas statute
Reference material, not legal advice.