---
title: "Texas privacy law (TDPSA): processors"
canonical: "https://dposchool.com/state-privacy-laws/state/texas/processors"
source: "https://statutes.capitol.texas.gov/Docs/BC/htm/BC.541.htm"
text_as_of: "2026-10-28"
last_reviewed: "2026-10-29"
language: "en-US"
publisher: "DPO School"
---

Texas Data Privacy and Security Act

# Texas privacy law (TDPSA): processors

Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review)

## Summary (not the statute text)

Processors must follow instructions and help with consumer requests, security (including, since 1 January 2026, data processed by an artificial intelligence system), breach notice and assessments. The contract must set out instructions, nature and purpose, data types, duration and the parties' rights and obligations. It must require confidentiality, deletion or return, compliance information, cooperation with assessments (or an independent assessor's report) and written flow-down to subcontractors.

## Key points

1. Processor duties: follow instructions and assist with requests, security, breach notice and assessments.

   Section: [§ 541.104(a)](https://statutes.capitol.texas.gov/Docs/BC/htm/BC.541.htm)

2. Security assistance extends to personal data in an artificial intelligence system (since 1 January 2026).

   Section: [§ 541.104(a)(2)](https://statutes.capitol.texas.gov/Docs/BC/htm/BC.541.htm)

3. Contract must state instructions, nature and purpose, data types, duration, rights and obligations.

   Section: [§ 541.104(b)(1) to (5)](https://statutes.capitol.texas.gov/Docs/BC/htm/BC.541.htm)

4. Contract must require confidentiality, deletion or return, compliance information, assessments and subcontractor flow-down.

   Section: [§ 541.104(b)(6)](https://statutes.capitol.texas.gov/Docs/BC/htm/BC.541.htm)

5. Processor may instead arrange an independent assessment and share the report.

   Section: [§ 541.104(c)](https://statutes.capitol.texas.gov/Docs/BC/htm/BC.541.htm)

6. Controller or processor status is a fact-based determination.

   Section: [§ 541.104(e)](https://statutes.capitol.texas.gov/Docs/BC/htm/BC.541.htm)

## Sources

- [https://statutes.capitol.texas.gov/Docs/BC/htm/BC.541.htm](https://statutes.capitol.texas.gov/Docs/BC/htm/BC.541.htm)

[Compare processors across all states](https://dposchool.com/state-privacy-laws/topic/processors)

## Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

- [Article 28: Processor](https://dposchool.com/gdpr/article/28) (processors)

## Status

Law as of October 28, 2026.

[Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed.

[Official text of the Texas statute](https://statutes.capitol.texas.gov/Docs/BC/htm/BC.541.htm)

Reference material, not legal advice.

## Other topics for Texas

- [Applicability](https://dposchool.com/state-privacy-laws/state/texas/applicability)
- [Consumer rights](https://dposchool.com/state-privacy-laws/state/texas/consumer-rights)
- [Sensitive data](https://dposchool.com/state-privacy-laws/state/texas/sensitive-data)
- [Controller duties](https://dposchool.com/state-privacy-laws/state/texas/controller-duties)
- [Enforcement](https://dposchool.com/state-privacy-laws/state/texas/enforcement)

## Navigation

[US State Privacy Laws](https://dposchool.com/state-privacy-laws) / [Texas](https://dposchool.com/state-privacy-laws/state/texas) / Processors

Previous: [Controller duties](https://dposchool.com/state-privacy-laws/state/texas/controller-duties)

Next: [Enforcement](https://dposchool.com/state-privacy-laws/state/texas/enforcement)

Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com).

## For AI agents

- Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt
- JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents