Law / United States / 
Texas
Texas Data Privacy and Security Act (HB 4), general applicability and scope
Tex. Bus. & Com. Code ch. 541, secs. 541.001-541.002
In force since .
A comprehensive regime rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, Data subject residence
- Audit expectation
- none
What it requires
- Determine whether you conduct business in Texas or serve Texas residents, process or sell personal data, and are not a small business under SBA size standards before relying on any TDPSA exemption.
- Treat information a Texas consumer restricted to a specific audience as covered personal data, not as exempt publicly available information.
- Confirm whether a sector exemption applies. TDPSA excludes state agencies, Gramm-Leach-Bliley Act (GLBA)-regulated financial institutions, Health Insurance Portability and Accountability Act (HIPAA) covered entities, nonprofits, higher-education institutions, and electric utilities.
These lines are LexLint's reading of the law's text. Also read by: Office of the Texas Attorney General (guidance, recorded ).
Who enforces it
Settledness
- As of
- Guidance link
- https://www.texasattorneygeneral.gov/consumer-protection/file-consumer-complaint/consumer-privacy-rights/texas-data-privacy-and-security-act
- Guidance body
- Office of the Texas Attorney General
- Open questions
- Which United States Small Business Administration size standard decides whether a person is a small business under Section 541.002(a)(3), and as of what date is the person measured against it?
What it makes you log
Logging duty
Sections 541.001 and 541.002 are definitions and scope and impose no record duty. The Act's records sit in sections this row does not cite: a documented data protection assessment that a controller makes available to the Attorney General on a civil investigative demand (541.105(a), (c) and 541.153(b)), and the optional record of a deletion request in 541.052(f). The scope clause reaches a person that conducts business in the state or produces a product or service consumed by Texas residents (541.002(a)(1)), and 541.001(7) defines a consumer as a resident of this state; the clause says consumed rather than targeted, and is read here as the market-reach prong.
- Kind
- None
- As of
What this law does
TDPSA governs private-sector processing of Texas residents' personal data. It applies to a person who conducts business in Texas, or produces a product or service consumed by Texas residents, and who processes or sells personal data, unless the person is a small business under SBA size standards (a limited exception for selling sensitive data under sec. 541.107 applies regardless of size).
The Act excludes state agencies, political subdivisions, Gramm-Leach-Bliley Act (GLBA)-regulated financial institutions, Health Insurance Portability and Accountability Act (HIPAA) covered entities, nonprofits, higher-education institutions, and electric utilities, and 'personal data' excludes deidentified data and publicly available information.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .