🇺🇸Texas Data Privacy and Security Act

Skin

← Back to laws in United States

Texas Data Privacy and Security Act

Texas Data Privacy and Security Act

The Texas Data Privacy and Security Act creates a state privacy framework for personal data processed in relation to Texas consumers. It uses the controller and processor model but has a distinctive applicability rule. It applies to a person that conducts business in Texas or produces products or services consumed by Texas residents, processes or sells personal data, and is not a small business as defined by the United States Small Business Administration, subject to statutory exceptions.

For organisations serving Texas residents, the law requires privacy notices, consumer rights handling, sensitive data consent, processor contracts, data protection assessments and Attorney General-facing evidence.

Applicability and exemptions

The Act excludes several entities and data categories, including certain state agencies, financial institutions or data subject to Title V of GLBA, covered entities or business associates governed by HIPAA rules, nonprofit organisations, institutions of higher education and specified utilities. It also exempts categories such as protected health information, certain research information, FCRA-regulated activity, FERPA-regulated data and other federally regulated data.

These exemptions should be mapped carefully. A business can have some data that is exempt and other personal data that remains covered.

Key Provisions

Applicability: doing business in Texas or producing products or services consumed by Texas residents, processing or selling personal data, and not being a covered small business, subject to exceptions.

Consumer rights: access, correction, deletion, portability and opt-out rights for targeted advertising, sale and certain profiling.

Privacy notice: controllers must provide a clear notice describing data categories, purposes, rights mechanisms and third-party sharing.

Sensitive data: controllers may not process sensitive data without consumer consent, and known children’s data must be handled consistently with COPPA.

Data protection assessments: required for targeted advertising, sale, high-risk profiling, sensitive data and other heightened-risk processing.

Consumer rights and response workflow

Texas consumers may exercise rights in relation to their personal data, including the right to confirm processing, access data, correct inaccuracies, delete personal data, obtain a portable copy and opt out of processing for targeted advertising, sale of personal data or profiling in furtherance of decisions producing legal or similarly significant effects.

Controllers generally must respond without undue delay and not later than 45 days after receiving the request, with a possible additional 45 days where reasonably necessary. If a request is declined, the controller must explain the justification and provide appeal instructions.

Privacy notice and sensitive data disclosures

A Texas privacy notice should describe categories of personal data processed, purposes, how consumers may exercise rights and appeal, categories of data shared with third parties, categories of third parties, and methods for submitting rights requests.

If a controller sells sensitive personal data, the Act requires a specific notice. If a controller sells biometric data, a specific notice is also required. These notices should be placed in the same location and manner as the privacy notice.

Practical risk area

Texas has a broad practical reach because the applicability test does not use the same high numerical processing threshold found in some other states. Businesses should not assume they are out of scope merely because they process fewer than 100,000 consumers.

Data protection assessments

Controllers must conduct and document data protection assessments for specified higher-risk processing, including targeted advertising, sale of personal data, certain profiling, sensitive data processing and other processing that presents heightened risk of harm. The assessment should weigh benefits against risks to consumer rights and consider safeguards, deidentified data, consumer expectations, context and the controller-consumer relationship.

The Attorney General may request assessments through the statutory enforcement process. Businesses should therefore prepare assessments as compliance evidence, not as informal internal notes.

What this means for you

If Texas law applies, prioritise a Texas-specific privacy notice, consumer request workflow, sensitive data consent, opt-out mechanisms, processor contracts and data protection assessments. Pay close attention to sale, targeted advertising, profiling and biometric data notices.

Other laws in United States
CA-DELETE

California Delete Act and Data Broker Requirements

California Privacy Protection Agency

Open law Read analysis
CPPA

California Privacy Rights Act and California Privacy Protection Agency provisions

California Privacy Protection Agency

Open law Read analysis
CLOUD-ACT

Clarifying Lawful Overseas Use of Data Act (CLOUD Act)

United States Department of Justice

Open law Read analysis
42-CFR-P2

Confidentiality of Substance Use Disorder Patient Records

U.S. Department of Health and Human Services, Office for Civil Rights

Open law Read analysis
CAN-SPAM

Controlling the Assault of Non-Solicited Pornography And Marketing Act

Federal Trade Commission

Open law Read analysis
CPNI

Customer Proprietary Network Information Rules

Federal Communications Commission

Open law Read analysis
DPPA

Drivers Privacy Protection Act

United States Department of Justice and federal courts

Open law Read analysis
ECPA-SCA

Electronic Communications Privacy Act and Stored Communications Act

United States Department of Justice

Open law Read analysis
FERPA

Family Educational Rights and Privacy Act

U.S. Department of Education, Student Privacy Policy Office

Open law Read analysis
GINA

Genetic Information Nondiscrimination Act

U.S. Equal Employment Opportunity Commission and federal health agencies

Open law Read analysis
HITECH

Health Information Technology for Economic and Clinical Health Act

U.S. Department of Health and Human Services, Office for Civil Rights

Open law Read analysis
HIPAA

Health Insurance Portability and Accountability Act of 1996

U.S. Department of Health and Human Services Office for Civil Rights

Open law Read analysis
IL-BIPA

Illinois Biometric Information Privacy Act

Illinois Attorney General and private enforcement

Open law Read analysis
MT-CDPA

Montana Consumer Data Privacy Act

Montana Attorney General, Office of Consumer Protection

Open law Read analysis
NJDPA

New Jersey Data Privacy Law

New Jersey Attorney General and Division of Consumer Affairs

Open law Read analysis
PRIVACY-ACT

Privacy Act of 1974

U.S. Department of Justice, Office of Privacy and Civil Liberties

Open law Read analysis
RI-DTPPA

Rhode Island Data Transparency and Privacy Protection Act

Rhode Island Attorney General

Open law Read analysis
UCPA

Utah Consumer Privacy Act

Utah Attorney General and Division of Consumer Protection

Open law Read analysis
VT-DPOSA

Vermont Data Privacy and Online Surveillance Act

Vermont Attorney General

Open law Read analysis
VPPA

Video Privacy Protection Act

United States Department of Justice and federal courts

Open law Read analysis