Texas Data Privacy and Security Act
Texas privacy law (TDPSA): processors
Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026
Summary (not the statute text)
Processors must follow instructions and help with consumer requests, security (including, since 1 January 2026, data processed by an artificial intelligence system), breach notice and assessments. The contract must set out instructions, nature and purpose, data types, duration and the parties' rights and obligations. It must require confidentiality, deletion or return, compliance information, cooperation with assessments (or an independent assessor's report) and written flow-down to subcontractors.
Key points
Processor duties: follow instructions and assist with requests, security, breach notice and assessments.
Section: § 541.104(a)
Security assistance extends to personal data in an artificial intelligence system (since 1 January 2026).
Section: § 541.104(a)(2)
Contract must state instructions, nature and purpose, data types, duration, rights and obligations.
Section: § 541.104(b)(1) to (5)
Contract must require confidentiality, deletion or return, compliance information, assessments and subcontractor flow-down.
Section: § 541.104(b)(6)
Processor may instead arrange an independent assessment and share the report.
Section: § 541.104(c)
Controller or processor status is a fact-based determination.
Section: § 541.104(e)
Sources
Compare processors across all states
Related GDPR articles
Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.
- Article 28: Processor (processors)
Law as of October 28, 2026.
Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.
Official text of the Texas statute
Reference material, not legal advice.