Processes personal data, in Texas

Tex. Labor Code secs. 21.403 to 21.405 · Read the law's page

• Treat genetic information you hold about an individual as confidential and privileged, whatever its source, except as Labor Code section 21.4031 provides (Tex. Labor Code sec. 21.403(a)).
• Do not disclose, or be compelled by subpoena or otherwise to disclose, genetic information about an individual unless the individual specifically authorized the disclosure in a written authorization that describes the information, names the recipient and states the purpose, or section 21.4031 allows it; the same bar applies to a secondary recipient that redisclosed the information (Tex. Labor Code secs. 21.403(b), (c), 21.4032).
• If you performed a genetic test, on the written request of the individual disclose the test results to the individual or to a physician the individual designates (Tex. Labor Code sec. 21.404).
• Destroy a sample of genetic material obtained from an individual for a genetic test promptly after the purpose for which it was obtained is accomplished, unless a court order, the individual's authorization, institutional-review-board-cleared research or a state screening test exception applies (Tex. Labor Code sec. 21.405).

Tex. Health & Safety Code sec. 181.151 · Read the law's page

• Do not reidentify or attempt to reidentify an individual who is the subject of any protected health information without the individual's consent or authorization if required under chapter 181 or other state or federal law (Tex. Health & Safety Code sec. 181.151).

Tex. Bus. & Com. Code sec. 521.052 · Read the law's page

• This binds any business that collects or maintains sensitive personal information (an individual's name combined with a Social Security number, driver's license or government-issued identification number, or a financial account, credit, or debit card number together with any required access code; or information that identifies an individual and relates to the individual's physical or mental health, health care, or payment for health care) in the regular course of business; a financial institution as defined by 15 U.S.C. § 6809 is exempt.
• Implement and maintain reasonable procedures, including taking any appropriate corrective action, to protect that sensitive personal information from unlawful use or disclosure. The statute states no further content for what 'reasonable' requires beyond this general standard.
• Destroy or arrange for the destruction of customer records containing sensitive personal information no longer to be retained, by shredding, erasing, or otherwise modifying the information to make it unreadable or indecipherable through any means.
• There is no private right of action for a violation of this duty; only the attorney general may enforce it, seeking a civil penalty of $2,000 to $50,000 per violation and injunctive relief under Section 521.151.

Tex. Bus. & Com. Code sec. 503.001, as amended by Tex. HB 149, 89th Legislature (2025) · Read the law's page

• Inform an individual and obtain consent before capturing their retina or iris scan, fingerprint, voiceprint, or record of hand or face geometry for a commercial purpose in Texas.
• Do not treat an individual's biometric identifiers appearing in publicly available online media as consent to capture them unless that individual made the media publicly available themselves.
• Do not sell, lease, or disclose a captured biometric identifier except for the narrow statutory exceptions covering identification of a missing or deceased person, a requested financial transaction, legal compulsion, or a law enforcement warrant.
• Store and transmit a captured biometric identifier with reasonable care equal to or exceeding the protection given your other confidential information, and destroy it within a reasonable time, no later than the first anniversary of when the collection purpose expires.
• Confirm any AI training use of biometric identifiers stays within the training, processing, or evaluation exemption. It ends once the AI system is deployed to uniquely identify a specific individual.

Tex. Bus. & Com. Code sec. 521.053, as amended by Tex. SB 768, 88th Legislature (2023) · Read the law's page

• If you conduct business in Texas and own or license computerized data that includes sensitive personal information, notify any individual whose sensitive personal information was, or is reasonably believed to have been, acquired by an unauthorized person in a breach of system security without unreasonable delay and no later than 60 days after determining that the breach occurred, except for a delay at a law enforcement agency's request or as necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
• Notify the Texas Attorney General as soon as practicable and no later than 30 days after determining the breach occurred, if the breach affects 250 or more Texas residents.
• Notify each nationwide consumer reporting agency if you must notify more than 10,000 persons of the breach at one time.
• Do not rely on this statute alone to cover a breach of biometric data with no accompanying Social Security, driver's license, or financial account number. Biometric data alone does not trigger this notification duty.

Tex. Bus. & Com. Code ch. 541, secs. 541.001-541.002 · Read the law's page

• Determine whether you conduct business in Texas or serve Texas residents, process or sell personal data, and are not a small business under SBA size standards before relying on any TDPSA exemption.
• Treat information a Texas consumer restricted to a specific audience as covered personal data, not as exempt publicly available information.
• Confirm whether a sector exemption applies. TDPSA excludes state agencies, GLBA-regulated financial institutions, HIPAA covered entities, nonprofits, higher-education institutions, and electric utilities.

Tex. Bus. & Com. Code sec. 541.106 · Read the law's page

• Take reasonable measures to ensure that deidentified data you hold cannot be associated with an individual (Tex. Bus. & Com. Code sec. 541.106(a)(1)).
• Publicly commit to maintaining and using deidentified data without attempting to reidentify it (Tex. Bus. & Com. Code sec. 541.106(a)(2)).
• Contractually obligate any recipient of the deidentified data to comply with chapter 541 (Tex. Bus. & Com. Code sec. 541.106(a)(3)).
• If you disclose pseudonymous data or deidentified data, exercise reasonable oversight to monitor compliance with the contractual commitments the data is subject to, and take appropriate steps to address any breach of them (Tex. Bus. & Com. Code sec. 541.106(d)).

Tex. Bus. & Com. Code secs. 541.001, 541.101(b)(4) · Read the law's page

• Obtain a Texas consumer's opt-in consent before processing sensitive data, including biometric or genetic data collected to uniquely identify the individual, racial or ethnic origin, religious belief, a health diagnosis, sexuality, immigration status, or precise geolocation.
• Follow the Children's Online Privacy Protection Act's consent framework, not TDPSA's general consent rule, when processing a known child's sensitive data.
• Do not treat an identifier derived solely from a photograph, or from a video or audio recording, as TDPSA biometric data requiring this consent. The statutory definition excludes recording-derived data.

Tex. Bus. & Com. Code secs. 541.051-541.053, 541.105 · Read the law's page

• Give a Texas consumer a means to confirm whether you process their personal data, access it, correct it, delete it, and receive a portable copy.
• Offer a Texas consumer an opt-out of targeted advertising, the sale of personal data, and profiling that produces a legal or similarly significant effect.
• Respond to a consumer rights request without undue delay and no later than 45 days after receipt, with one 45-day extension available, and respond to an appeal of a refusal within 60 days.
• Conduct and document a data protection assessment before targeted advertising, sale of personal data, certain profiling, or sensitive-data processing.

Tex. Bus. & Com. Code secs. 541.151, 541.154-541.156 · Read the law's page

• Expect TDPSA violations to be enforced exclusively by the Texas Attorney General, never by a private plaintiff.
• Cure a violation and confirm the cure in writing within 30 days of Attorney General notice to avoid a civil penalty of up to $7,500 per violation.
• Do not treat the absence of individual lawsuits as low risk. The Attorney General is actively litigating a TDPSA enforcement action over data sales through embedded SDKs.

Tex. Bus. & Com. Code ch. 542 (secs. 542.001-542.004) · Read the law's page

• This chapter applies only to a business entity with fewer than 250 employees that owns or licenses computerized data including sensitive personal information, as those terms are defined by Section 521.002.
• It is a safe harbor, not a duty: if such an entity is sued over a breach of system security and demonstrates that, at the time of the breach, it had implemented and maintained a cybersecurity program meeting Section 542.004's requirements, the claimant may not recover exemplary damages from it. A qualifying program must contain administrative, technical, and physical safeguards; conform to a named industry-recognized cybersecurity framework (the NIST Cybersecurity Framework, NIST SP 800-171, NIST SP 800-53/53A, the FedRAMP Security Assessment Framework, the CIS Critical Security Controls, the ISO/IEC 27000-series, the HITRUST Common Security Framework, the Secure Controls Framework, SOC 2, or a similar framework); and be scaled by headcount: simplified measures such as password policies and employee training below 20 employees, the CIS Controls Implementation Group 1 from 20 to 99 employees, and full conformance with a named framework from 100 to 249 employees.
• The chapter creates no duty to adopt a program and no cause of action of its own; it only removes exemplary-damages exposure for a qualifying entity that already has one at the time of a breach.

Tex. Health & Safety Code secs. 174.006, 174.007 · Read the law's page

• If you are a medical facility, research facility, company or nonprofit organization that conducts research on or testing of genome sequencing or the human genome in Texas, do not store any genome sequencing data of a Texas resident at a location within the borders of a country that is a foreign adversary (Tex. Health & Safety Code sec. 174.007(a)).
• Ensure the security of the genome sequencing data of Texas residents you store, including data stored through a third-party storage contract, using reasonable encryption methods, restriction on access and other cybersecurity best practices (Tex. Health & Safety Code sec. 174.007(b)).
• Ensure genome sequencing data of Texas residents, other than open data, is inaccessible to any person located within the borders of a country that is a foreign adversary; this does not apply to data collected as part of a clinical trial or other biomedical research study subject to, or conducted in accordance with, the federal rule section 174.007(d) cites (Tex. Health & Safety Code sec. 174.007(c), (d)).
• Do not sell or otherwise transfer genomic sequencing data of Texas residents, as part of a bankruptcy proceeding or a chapter 11 plan of reorganization, to a foreign adversary, a state-owned enterprise of a foreign adversary, an organization domiciled in a foreign adversary country, or an owned or controlled subsidiary or affiliate of such an organization (Tex. Health & Safety Code sec. 174.006).

Tex. Bus. & Com. Code sec. 501.001 · Read the law's page

• Unless you are a government, do not intentionally communicate or make an individual's social security number available to the public, display it on a card or device required to access a product or service, or print it on mailed material unless state or federal law requires it or the mail is an application or form of a kind section 501.001(f) lists (Tex. Bus. & Com. Code sec. 501.001(a)(1), (2), (5), (f)).
• Unless you are a government, do not require an individual to transmit the individual's social security number over the Internet unless the connection is secure or the number is encrypted, and do not require it for access to a website unless a password, personal identification number or other authentication device is also required (Tex. Bus. & Com. Code sec. 501.001(a)(3), (4)).
• If an individual asks you in writing to stop using the individual's social security number in a manner section 501.001(a) prohibits, comply within 30 days of receiving the request, without a fee (Tex. Bus. & Com. Code sec. 501.001(d)).

Tex. Bus. & Com. Code sec. 501.002 · Read the law's page

• Do not print an individual's social security number on a card or other device required to access a product or service you provide unless the individual has requested that printing in writing, and do not require the request as a condition of access (Tex. Bus. & Com. Code sec. 501.002(a)).

Tex. Bus. & Com. Code secs. 501.052, 501.053 · Read the law's page

• If you require an individual to disclose a social security number to obtain goods or services from you or to enter into a business transaction with you, first adopt a privacy policy, make it available to the individual and maintain under it the confidentiality and security of the number disclosed (Tex. Bus. & Com. Code sec. 501.052(a)).
• State in the privacy policy how personal information is collected, how and when it is used, how it is protected, who has access to it and the method of its disposal (Tex. Bus. & Com. Code sec. 501.052(b)).

Tex. Ins. Code ch. 546 · Read the law's page

• If you are a health benefit plan issuer and ask an applicant to submit to a genetic test in connection with the application, notify the applicant that the test is required, disclose the proposed use of the results and obtain the applicant's written informed consent before the test is administered (Tex. Ins. Code sec. 546.051(a)).
• Do not use the results of that test to induce the purchase of coverage (Tex. Ins. Code sec. 546.051(c)).
• Do not use genetic information, or an applicant's refusal to submit to a genetic test, to reject, deny, limit, cancel, refuse to renew, increase the premiums for or otherwise adversely affect eligibility for or coverage under the plan (Tex. Ins. Code sec. 546.052).
• Destroy a sample of genetic material obtained for a genetic test promptly after the purpose for which it was obtained is accomplished, unless an exception in section 546.054 applies (Tex. Ins. Code sec. 546.054).
• On the written request of an individual who submitted to a genetic test, disclose the test results to the individual or to a physician the individual designates (Tex. Ins. Code sec. 546.101(a)).
• Do not disclose, or be compelled to disclose, genetic information about an individual unless the individual specifically authorized the disclosure by an authorization that meets section 546.104 or an exception in section 546.103 applies (Tex. Ins. Code secs. 546.102(b), 546.103, 546.104).