Law / United States / 
Texas
Texas Data Privacy and Security Act (TDPSA), no fixed applicability threshold
In force since .
A personal data rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting
- Audit expectation
- on_request
- Who audits it
- Regulator, Independent third party
- Where the report goes
- Produced on request
What it requires
- TDPSA applies to you if you do business in Texas or produce a product or service consumed by Texas residents and you process or sell personal data, unless you qualify as a small business under U.S. Small Business Administration size standards, which vary by industry rather than a fixed revenue or consumer-count number.
- Personal data excludes deidentified data and publicly available information, meaning information lawfully available through government records or that you have a reasonable basis to believe is lawfully available to the public through widely distributed media, the consumer, or someone the consumer disclosed it to.
- Even if you qualify as a small business, you may not sell sensitive personal data without the consumer's prior consent.
These lines are LexLint's reading of the law's text. Also read by: Texas Attorney General (guidance, recorded ).
In the frameworks
- NIST AI RMF
- MAP 1.6System requirements (e.g., “the system shall respect the privacy of its users”) are elicited from and understood by relevant AI actors. Design decisions take socio-technical implications into account to address AI risks.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://www.texasattorneygeneral.gov/consumer-protection/file-consumer-complaint/consumer-privacy-rights/texas-data-privacy-and-security-act
- Guidance body
- Texas Attorney General
- Open questions
- Which Small Business Administration size standard decides whether a data collector is "a small business" under Tex. Bus. & Com. Code section 541.002(a)(3), and as of what date is its size measured?
- Is a company with no Texas office one that "produces a product or service consumed by residents of this state" under Tex. Bus. & Com. Code section 541.002(a)(1) when it only collects data about Texas residents?
What it makes you log
Who may demand the log
Regulator
What the log must hold
Decision basis
Logging duty
A controller must conduct and document a data protection assessment of processing for targeted advertising, sale of personal data, risky profiling, sensitive data and any other heightened-risk processing, and must make an assessment available to the Attorney General under a civil investigative demand. The chapter states no retention period for the assessment. A processor must provide the information a controller needs to document an assessment (section 541.104(a)(3)) and may arrange an independent assessment of its own measures and report it to the controller on request (section 541.104(c)). The consumer-request, notice and sale duties in sections 541.051 to 541.103 state no record. Section 541.107 bars a small business from selling sensitive data without consent and states no record.
- Kind
- Explicit
- As of
- Provision
- Tex. Bus. & Com. Code section 541.105(a)
- Trigger
- personal_data_processing
What this law does
TDPSA applies to any person conducting business in Texas, or producing a product or service consumed by Texas residents, that processes or sells personal data and is not a small business as defined by the United States Small Business Administration, except that the sensitive-data-sale consent duty in section 541.107 applies even to a small business.
This is deliberately not a fixed dollar-revenue or consumer-count threshold; the SBA's small-business size standards vary by industry, often revenue in the tens of millions or employee counts in the hundreds, so TDPSA reaches many mid-sized data collectors that fall below other states' 100,000-consumer or $25-million thresholds.
Personal data excludes deidentified data and publicly available information, defined as information lawfully available through government records or that a business has a reasonable basis to believe is lawfully available to the public through widely distributed media, by the consumer, or by a person the consumer disclosed it to. Enforcement is by the Attorney General only, with a 30-day cure period; TDPSA carries no private right of action.
When LexLint raises it
When your app profile says your app crawls the web or trains models.
Back to the example · Lint your app
Page updated .