Texas Data Privacy Law: Where Things Stand in 2026
The Texas Data Privacy and Security Act (TDPSA) went into effect July 1, 2024. Two years later, enforcement is active, Texas Attorney General actions have started to establish how the law will be applied in practice, and organizations operating in Texas without a mature TDPSA compliance program are carrying real regulatory risk.
Texas joins 20+ states with comprehensive consumer privacy laws, and the TDPSA has several features that make it more expansive than some comparable laws. Unlike the California Consumer Privacy Act (CCPA), the TDPSA has no minimum revenue threshold — it applies to any business that processes the personal data of Texas residents at commercial scale, regardless of revenue. That scope covers a larger population of businesses than most comparable state laws.
What the TDPSA Requires
The TDPSA gives Texas residents five rights over their personal data held by covered businesses:
- Right to know: What personal data a company collects and how it’s used
- Right to access: A portable copy of their personal data
- Right to correct: Inaccurate personal data must be corrected on request
- Right to delete: Personal data must be deleted on request, subject to retention obligations
- Right to opt out: Of sale of personal data, targeted advertising, and automated profiling
Businesses must respond to consumer rights requests within 45 days. If additional time is needed, a single 45-day extension is allowed with notice to the consumer. A formal appeals process must be established for consumers whose requests are denied.
Who the TDPSA Covers
The TDPSA applies to businesses that:
- Conduct business in Texas or produce products or services consumed by Texas residents, AND
- Process or sell personal data
There is no minimum consumer count threshold for general coverage (unlike CCPA’s 100,000 consumer threshold). Small businesses are exempt if they have fewer than 100 employees and meet additional criteria. Specific exemptions exist for HIPAA-covered entities, financial institutions subject to GLBA, government entities, nonprofits, and higher education institutions.
Data Protection Assessments: The TDPSA Requirement Most Organizations Miss
The TDPSA requires businesses to conduct data protection assessments for high-risk processing activities: targeted advertising, sale of personal data, profiling that produces legal or significant effects, processing sensitive personal data, and processing that presents a heightened risk of harm. These assessments must weigh the benefits of the processing against the risks to consumers.
Most organizations that CyberOne engages with for TDPSA compliance have handled the public-facing requirements (privacy policy updates, opt-out mechanisms) but haven’t built the internal data protection assessment process. These assessments are also required for new processing activities before they begin — a process requirement that needs to be embedded in product development and marketing workflows.
CyberOne’s data governance assessment covers the data mapping foundation these assessments require: knowing what data you collect, where it flows, what it’s used for, and which third parties receive it.
Contracts with Data Processors
Businesses that engage third-party processors (vendors who process personal data on their behalf) must have contracts with those processors that meet specific TDPSA requirements: the processor’s instructions must be specified, confidentiality obligations must be included, the processor must assist the business in fulfilling consumer rights requests and security obligations, and the processor must delete or return data upon contract termination.
Reviewing and updating data processor contracts is one of the most operationally intensive TDPSA compliance activities for organizations with large vendor ecosystems. CyberOne’s third-party risk assessment process covers vendor data handling review alongside technical security assessment.
Sensitive Personal Data: Higher-Bar Obligations
The TDPSA defines a category of sensitive personal data that requires explicit consent before processing: racial or ethnic origin, religious beliefs, mental or physical health conditions, sexual orientation, citizenship or immigration status, genetic or biometric data, children’s data, and precise geolocation data.
For organizations that process any of these categories — healthcare platforms, HR systems, apps with biometric authentication, children’s applications — the consent requirement is an affirmative obligation that can’t be satisfied by a buried privacy policy clause. Explicit, informed consent must be obtained before processing begins.
Enforcement and Penalties
The Texas Attorney General enforces the TDPSA. The law gives businesses a 30-day cure period after receiving a notice of violation — but cure is only available when the violation is curable, and that determination is at the AG’s discretion. Civil penalties reach $7,500 per violation.
Organizations that don’t have documented compliance programs — privacy policies that actually reflect current practices, consumer rights request processes that function within the 45-day window, data protection assessments for high-risk processing, and contracts with processors — are exposed to enforcement risk that existing HIPAA or PCI compliance programs don’t address.