Privacy Law Library

Identity Theft Enforcement and Protection Act (breach notification and sensitive personal information protection)

Texas Breach Notification Law

Breach notification · Data security

Requires businesses to protect and properly destroy sensitive personal information and to notify affected individuals and, for breaches affecting 250 or more Texans, the attorney general. Notice to individuals is due within 60 days and to the attorney general within 30 days of determining that a breach occurred.

Where

Texas

Citation

Tex. Bus. & Com. Code ch. 521 (521.052, 521.053, 521.151)

Status

In force

In force since

2009-04-01

Last amended

2023-09-01

Enforced by

Texas Attorney General

People can sue

No

Penalties

$2,000 to $50,000 per violation; for late breach notice, up to $100 per individual per day, capped at $250,000 per breach; injunctions and fees (521.151).

Applies to

• Persons conducting business in Texas that own or license computerized data containing sensitive personal information (521.053(b))
• Persons maintaining such data for another (must notify the owner) (521.053(c))
• Businesses, including nonprofit athletic associations, that collect or maintain sensitive personal information (521.052); GLBA financial institutions are exempt from 521.052