Law / United States / 
Texas
Identity Theft Enforcement and Protection Act, breach notification
Tex. Bus. & Com. Code sec. 521.053, as amended by Tex. SB 768, 88th Legislature (2023)
In force since .
A breach notification rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Data subject residence
- Audit expectation
- none
What it requires
- If you conduct business in Texas and own or license computerized data that includes sensitive personal information, notify any individual whose sensitive personal information was, or is reasonably believed to have been, acquired by an unauthorized person in a breach of system security without unreasonable delay and no later than 60 days after determining that the breach occurred, except for a delay at a law enforcement agency's request or as necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
- Notify the Texas Attorney General as soon as practicable and no later than 30 days after determining the breach occurred, if the breach affects 250 or more Texas residents.
- Notify each nationwide consumer reporting agency if you must notify more than 10,000 persons of the breach at one time.
- Do not rely on this statute alone to cover a breach of biometric data with no accompanying Social Security, driver's license, or financial account number. Biometric data alone does not trigger this notification duty.
These lines are LexLint's reading of the law's text. Also read by: Office of the Texas Attorney General (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Private right of actionNo
Penalty structure
Section 521.151(a): a person who violates the chapter is liable to the state for a civil penalty of at least $2,000 but not more than $50,000 for each violation. Section 521.151(a-1) adds, for a person who fails to take reasonable action to comply with the individual notice duty in section 521.053(b), a civil penalty of not more than $100 for each individual to whom notification is due for each consecutive day of the failure, and civil penalties under section 521.151 may not exceed $250,000 for all individuals to whom notification is due after a single breach.
- Rule
- Per violation only
- As of
- Minimum
- 2,000
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 50,000
Who enforces it
Enforcement body
Texas Attorney General, who may bring an action to recover the civil penalty under Business and Commerce Code section 521.151.
Settledness
The Attorney General's data breach reporting page counts the 30 days from the discovery of the breach, where the statute and the Attorney General's page on the Act count them from the determination that a breach occurred.
- As of
- Guidance link
- https://www.texasattorneygeneral.gov/consumer-protection/file-consumer-complaint/consumer-privacy-rights/identity-theft-enforcement-and-protection-act
- Guidance body
- Office of the Texas Attorney General
- Open questions
- Does the 30-day period for notifying the Attorney General under Section 521.053(i) run from the date a person determines that the breach occurred, or from the earlier date the person discovers the breach?
What it makes you log
Logging duty
Section 521.053 requires notice of a breach of system security to affected individuals within 60 days (521.053(b)), to the owner of the data by a person that maintains it (521.053(c)), to consumer reporting agencies above 10,000 persons (521.053(h)), and to the Attorney General within 30 days where at least 250 Texas residents are involved, through a form with the listed particulars (521.053(i)). Each is a notification and none requires the person to keep a record of the breach. An information security policy that sets the person's own notification procedures (521.053(g)) is a policy, not a record. The Attorney General's public listing of notices (521.053(j)) is the State's record, not the controller's. The scope clause reaches a person that conducts business in this state (521.053(b)); the Attorney General notice turns on the number of residents of this state (521.053(i)).
- Kind
- None
- As of
What this law does
A person conducting business in Texas that owns or licenses computerized data including sensitive personal information (a Social Security, driver's license, or government identification number, or a financial account number with an access code, each combined with a name, or certain health information) must notify affected Texas residents without unreasonable delay and no later than 60 days after determining a breach of system security occurred.
If 250 or more Texas residents are affected, the person must also notify the Texas Attorney General as soon as practicable and no later than 30 days after that determination, and a person notifying more than 10,000 persons at one time must also notify each nationwide consumer reporting agency.
Biometric data such as a fingerprint, voiceprint, or retina or iris image sits in the chapter's separate, broader personal identifying information definition and does not itself trigger this notification duty.
Enforcement of this notification duty is exclusive to the Attorney General, with a civil penalty of $2,000 to $50,000 per violation, and this section creates no private right of action, though a separate provision of the same chapter (sec. 521.152) ties a violation of the identity theft prohibition in sec. 521.051 to a private action under the Deceptive Trade Practices Act.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .