Texas Data Privacy and Security Act

Section 541.001 DEFINITIONS. In this chapter, unless a

The section defines key terms including consumer as a state resident in personal or household context, child as under 13, consent as clear affirmative action excluding general terms of service acceptance and dark patterns, controller and processor for data processing roles, sensitive data encompassing racial or ethnic origin, religious beliefs, health diagnosis, sexuality, immigration status, genetic or biometric identification, child data, and precise geolocation within 1,750 feet, sale as sharing for consideration excluding transfers to service providers, processors, affiliates, and mergers or acquisitions, profiling as solely automated assessment, and targeted advertising excluding single-site and current search context ads.

Section 541.002 APPLICABILITY OF CHAPTER. (a) This chapter

The law applies to persons that do business in Texas or reach Texas residents, process or sell personal data, and are not small businesses as defined by the federal Small Business Administration, except for certain requirements. State agencies, political subdivisions, financial institutions under Gramm-Leach-Bliley Act, covered entities under HIPAA and HITECH, nonprofits, higher education institutions, and electric utilities are excluded.

Section 541.003 CERTAIN INFORMATION EXEMPT FROM CHAPTER. The

The law does not apply to protected health information, health records, patient identifying information under federal substance abuse regulations, identifiable private information in human subjects research under federal standards or ICH guidelines, health care quality improvement records, patient safety work product, deidentified health information, limited data sets as defined by HIPAA, information used for public health activities, credit reporting information under the Fair Credit Reporting Act, driver's license information under the Driver's Privacy Protection Act, student records under FERPA, farm credit data, employment-related data about applicants or employees, emergency contact information, and benefits administration data.

Section 299b 21 et seq.);

This section continues the list of exempt information from section 541.003, including deidentified health information under HIPAA requirements, information maintained with and indistinguishable from HIPAA-exempt information, limited data sets under HIPAA standards, public health activity information, credit reporting activities under Fair Credit Reporting Act, driver's license data under the Driver's Privacy Protection Act, education records under FERPA, farm credit data, employment application and service data, emergency contact information, and benefits administration data.

Section 541.004 INAPPLICABILITY OF CHAPTER. This chapter

The law does not apply to processing of personal data by a person for purely personal or household purposes.

Section 541.005 Effect of compliance with parental consent

Entities that follow verifiable parental consent rules under the Children's Online Privacy Protection Act for online-collected data satisfy any parental consent requirement under this chapter.

Section 541.051 Consumer's personal data rights; request to

Consumers may request that controllers confirm processing and provide access to personal data, correct inaccuracies, delete data, obtain a portable copy of data previously provided in a digital format, or opt out of targeted advertising, data sales, or profiling with legal or similarly significant effects. A parent or legal guardian may exercise these rights on behalf of a known child.

Section 541.052 CONTROLLER RESPONSE TO CONSUMER REQUEST. (a)

Controllers must respond to consumer requests within 45 days, extendable by an additional 45 days if complex or numerous, and must inform consumers of refusals within the same timeframe. Controllers must provide free responses at least twice per year but may charge reasonable fees or decline manifestly unfounded, excessive, or repetitive requests. For deletion requests where data came from other sources, controllers may retain minimal deletion records or opt the consumer out of further processing, and controllers must authenticate requests using reasonable efforts.

Section 541.053 Appeal process

Controllers must establish a reasonably accessible and conspicuous appeal process similar to the initial rights request process. Controllers must respond to appeals within 60 days with written explanation of actions taken or not taken. If an appeal is denied, the controller must provide information for contacting the attorney general to file a complaint.

Section 541.054 Waiver or limitation of consumer rights

Section 541.055 Methods for submitting consumer requests

Controllers must establish at least two secure and reliable methods for consumers to submit rights requests, considering how consumers normally interact with the controller, security needs, and identity authentication. Controllers cannot require new account creation but may require use of existing accounts. If the controller has a website, it must provide a mechanism to submit disclosure requests, except that controllers operating exclusively online with direct consumer relationships need only provide an email address.

Section 541.101 CONTROLLER DUTIES; TRANSPARENCY. (a) A

Controllers must limit personal data collection to what is proportionate to disclosed purposes and maintain reasonable security practices appropriate to data volume and nature. Controllers may not process data for undisclosed purposes without consent, violate non-discrimination laws, deny goods or services to consumers exercising their rights, charge differently, reduce service quality, or process sensitive data or known child data without required consent. However, controllers may offer different prices or quality for voluntary loyalty programs or when a consumer exercises opt-out rights.

Section 541.102 Privacy notice

Controllers must provide consumers with accessible and clear notices including categories of personal data and sensitive data processed, processing purposes, consumer rights exercise methods and appeal procedures, categories of third parties receiving data, and submission methods for consumer requests. Controllers selling sensitive personal data or biometric data must separately post specific notices in the same location and manner as the main privacy notice.

Section 541.103 Sale of data to third parties and processing

When controllers sell personal data to third parties or use it for targeted advertising, they must clearly disclose the process and inform consumers how to exercise the right to opt out.

Section 541.104 Duties of processor

Processors must follow a controller's instructions and support the controller in meeting duties under the chapter, including responding to consumer requests, complying with data security and breach notification requirements, and supplying information for data protection assessments. Controller-processor contracts must specify processing instructions, nature and purpose, data types, duration, and mutual responsibilities; processors must ensure confidentiality obligations, delete or return data when services end unless law requires retention, provide compliance information to controllers, permit reasonable assessments by controllers or independent assessors, and impose equivalent requirements on any subcontractors through written agreements. Processors may alternatively arrange for a qualified independent assessor to evaluate their measures using accepted standards and share the assessment report with controllers when requested.

Section 541.105 DATA PROTECTION ASSESSMENTS. (a) A

Controllers must conduct and document data protection assessments for targeted advertising processing, personal data sales, profiling that presents reasonably foreseeable risk of unfair or deceptive treatment, unlawful disparate impact, financial, physical or reputational injury, privacy intrusion offensive to a reasonable person, or other substantial consumer injury, sensitive data processing, and any processing activities presenting heightened consumer harm risk. Assessments must identify and weigh direct or indirect benefits to the controller, consumer, other stakeholders, and public against potential risks to consumer rights, considering deidentified data use, consumer expectations, processing context, and controller-consumer relationship. Controllers must make assessments requested by the attorney general available under civil investigative demand.

Section 541.106 DEIDENTIFIED OR PSEUDONYMOUS DATA. (a) A

Controllers holding deidentified data must implement reasonable safeguards against re-association, make public commitments to maintain it without reidentification, and impose contractual duties on recipients. The law does not require controllers or processors to reidentify data, keep data identifiable, or fulfill consumer rights requests when they cannot associate the request with personal data or when the burden would be unreasonable, provided they do not use the data to recognize consumers or share it beyond processors. Consumer rights and controller duties do not apply to pseudonymous data when the controller keeps identifying information separately under technical and organizational protections.

Section 541.107 REQUIREMENTS FOR SMALL BUSINESSES. (a) A

Small businesses as defined in the law may not sell sensitive personal data without the consumer's prior consent, and violations are subject to civil penalties.

Section 541.151 ENFORCEMENT AUTHORITY EXCLUSIVE. The

The attorney general holds exclusive authority to enforce this law.

Section 541.152 Internet website and complaint mechanism

The attorney general must publish on its website information about controller and processor responsibilities and consumer rights under the law, and provide an online tool for consumers to submit complaints.

Section 541.153 INVESTIGATIVE AUTHORITY. (a) If the

The attorney general may issue civil investigative demands when they have reasonable cause to believe someone violated the law, using the same procedures as under another state statute. Through a civil investigative demand, the attorney general may request data protection assessments from controllers and assess them for compliance with relevant sections.

Section 541.154 Notice of violation of chapter; opportunity

Before suing for violations, the attorney general must notify the person in writing at least 30 days in advance, specifying the alleged violations. The person may avoid action by curing the violation within this period and providing the attorney general with a written statement confirming the cure, consumer notification if contact information is available, supporting documentation, and policy changes to prevent recurrence.

Section 541.155 CIVIL PENALTY; INJUNCTION. (a) A person who

A person violating the law after the cure period or breaching their written cure statement faces civil penalties up to 7,500 dollars per violation. The attorney general may recover penalties, seek injunctions against future violations, or seek both remedies, and may also recover reasonable attorney's fees and investigative expenses; collected penalties must be deposited according to state government code.

Section 541.156 No private right of action

This law does not create or become subject to a private cause of action.

Section 541.201 CONSTRUCTION OF CHAPTER. (a) This chapter

The law does not restrict controllers' or processors' ability to comply with laws or government inquiries, investigate or defend legal claims, fulfill consumer requests or contracts, protect essential interests in life or safety, prevent fraud or illegal activity, maintain system security, conduct approved institutional research with reasonable reidentification safeguards, or help others do these things. The law does not prevent sharing data covered by evidentiary privilege, restrict free speech, or require disclosure of trade secrets.

Section 541.202 Collection, use, or retention of data for

The law does not restrict controllers' or processors' ability to collect, use, or retain data for internal research on product development or repair, product recalls, fixing technical errors, or internal operations that align with consumer expectations, follow logically from the consumer relationship, or relate to requested products or services. Requirements do not apply if compliance would breach an evidentiary privilege under state law.

Section 541.203 Disclosure of personal data to third-party

A controller or processor that shares personal data with a recipient in compliance with chapter requirements does not violate the chapter if the recipient later violates it, provided the disclosing party had no actual knowledge of the recipient's intent to violate. A third party receiving such data also does not violate the chapter for violations by the original controller or processor.

Section 541.204 Processing of certain personal data by

A controller may only process personal data for purposes listed in the subchapter unless the chapter otherwise permits. Processing must be reasonably necessary and proportionate to those listed purposes, and must constitute an appropriate, targeted scope in relation to those specific purposes.

Section 541 202(a) must, where applicable, take into account the

Personal data collected, used, or retained must be protected by fitting administrative, technical, and physical safeguards that maintain confidentiality, integrity, and availability and mitigate reasonably foreseeable harms to consumers, taking into account the collection's nature and purpose. Controllers claiming exemptions bear the burden of proving the processing qualifies for and meets the requirements of the preceding provisions. Processing data for purposes listed in Section 541.201 does not automatically classify an entity as a controller for that processing.

Section 541.205 LOCAL PREEMPTION. This chapter supersedes

The chapter supersedes and preempts any local ordinances, resolutions, rules or other regulations by political subdivisions regarding the processing of personal data by controllers or processors. The Department of Information Resources must create a public feedback portal by September 1, 2024, keep it open for at least 90 days, and deliver an implementation status report to the public by January 1, 2025.

Section 4 Data protection assessments required to be

Data protection assessments required under Section 541.105 apply only to processing activities occurring after this Act's effective date and have no retroactive effect.

Section 5 Not later than July 1, 2024, the attorney general

Section 6 Severability and effective date

The Act's provisions are severable, so if any provision is found invalid, the remaining portions remain valid. The Act takes effect July 1, 2024, except Section 541.055(e) which takes effect January 1, 2025.