Law / United States / 
Texas
Texas Data Privacy and Security Act (TDPSA), no fixed applicability threshold
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
What follows is LexLint's own research summary of this law, not legal advice.
In force since 1 July 2024.
A personal data rule binding private bodies.
As of 29 August 2026.
What it requires
- TDPSA applies to you if you do business in Texas or produce a product or service consumed by Texas residents and you process or sell personal data, unless you qualify as a small business under U.S. Small Business Administration size standards, which vary by industry rather than a fixed revenue or consumer-count number.
- Personal data excludes deidentified data and publicly available information, meaning information lawfully available through government records or that you have a reasonable basis to believe is lawfully available to the public through widely distributed media, the consumer, or someone the consumer disclosed it to.
- Even if you qualify as a small business, you may not sell sensitive personal data without the consumer's prior consent.
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
TDPSA applies to any person conducting business in Texas, or producing a product or service consumed by Texas residents, that processes or sells personal data and is not a small business as defined by the United States Small Business Administration, except that the sensitive-data-sale consent duty in section 541.107 applies even to a small business.
This is deliberately not a fixed dollar-revenue or consumer-count threshold; the SBA's small-business size standards vary by industry, often revenue in the tens of millions or employee counts in the hundreds, so TDPSA reaches many mid-sized data collectors that fall below other states' 100,000-consumer or $25-million thresholds.
Personal data excludes deidentified data and publicly available information, defined as information lawfully available through government records or that a business has a reasonable basis to believe is lawfully available to the public through widely distributed media, by the consumer, or by a person the consumer disclosed it to. Enforcement is by the Attorney General only, with a 30-day cure period; TDPSA carries no private right of action.
When LexLint raises it
crawls_webtrains_models
Read the law
official text, Texas Constitution and Statutes (statutes.capitol.texas.gov)
Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.