Texas Data Privacy and Security Act

TDPSA

Comprehensive privacy

Texas's comprehensive consumer privacy law. It gives Texas consumers rights to access, correct, delete, and port their personal data and to opt out of targeted advertising, sale, and significant profiling, and requires controllers to give privacy notices, get consent for sensitive data, and run data protection assessments. It has no revenue threshold; it applies to any covered business that is not an SBA-defined small business.

Where: Texas
Citation: Tex. Bus. & Com. Code ch. 541 (541.001-541.205)
Status: In force
In force since: 2024-07-01
Last amended: 2026-01-01
Enforced by: Texas Attorney General (exclusive; 541.151)
People can sue: No
Penalties: Civil penalty up to $7,500 per violation, plus injunction and attorney's fees, after written notice and a 30-day cure period (541.154-541.155).
Applies to: Persons that conduct business in Texas or produce products or services consumed by Texas residents, process or sell personal data, and are not small businesses as defined by the U.S. Small Business Administration (541.002(a))
Small businesses only for the rule barring sale of sensitive data without prior consent (541.107)
Processors acting on behalf of controllers (541.104)
Excludes state agencies and political subdivisions, GLBA financial institutions and data, HIPAA covered entities and business associates, nonprofits, institutions of higher education, and certain electric utilities and retail electric providers (541.002(b))

What a privacy notice must say

Post a clear privacy notice listing categories of personal data, purposes, how to exercise and appeal rights, third-party sharing, and request methods.Tex. Bus. & Com. Code 541.102(a)
Clearly and conspicuously disclose any sale of personal data or targeted advertising and how to opt out.Tex. Bus. & Com. Code 541.103
Controllers that sell sensitive or biometric data must post the statutory 'NOTICE: We may sell your sensitive personal data' (or biometric) statement.Tex. Bus. & Com. Code 541.102(b)-(c)

Rights it gives people

Consumers may confirm processing and access, correct, delete, obtain a portable copy of, and opt out of targeted advertising, sale, and significant-effect profiling of their personal data; parents may act for a known child.Tex. Bus. & Com. Code 541.051
Honor opt-out requests sent by an authorized agent, including through a browser setting, extension, or global device setting (universal opt-out).Tex. Bus. & Com. Code 541.055(e) · From 2025-01-01

Practices it requires

Respond to consumer requests within 45 days (one 45-day extension with notice), free of charge at least twice a year.Tex. Bus. & Com. Code 541.052(b), (d)
Limit collection to what is adequate, relevant, and reasonably necessary; do not process sensitive data without consent (COPPA-compliant processing for a known child's data).Tex. Bus. & Com. Code 541.101(a)(1), (b)(4)
Small businesses may not sell sensitive personal data without the consumer's prior consent.Tex. Bus. & Com. Code 541.107
Provide at least two secure request methods without requiring a new account.Tex. Bus. & Com. Code 541.055(a)-(b)
Offer an appeal process; decide appeals within 60 days and, on denial, point the consumer to the attorney general's complaint mechanism.Tex. Bus. & Com. Code 541.053
Conduct and document data protection assessments for targeted advertising, sale, risky profiling, sensitive data, and other heightened-risk processing; produce them to the attorney general on civil investigative demand.Tex. Bus. & Com. Code 541.105

Security duties

Maintain reasonable administrative, technical, and physical data security practices.Tex. Bus. & Com. Code 541.101(a)(2)

Other duties

Processor contracts must set processing instructions, duration, confidentiality, deletion or return, and audit cooperation terms; processors must assist with AI-system data security (added 2026).Tex. Bus. & Com. Code 541.104

Sources

Checked against these sources on 2026-09-24 by research agent (Claude), primary sources.

Research reference, not legal advice.