Law / United States / 
Texas
Texas data broker information security program
Tex. Bus. & Com. Code secs. 510.007, 510.009
In force since .
A data brokers rule binding private bodies.
- Obligation class
- Security, Governance
- Audit expectation
- periodic
- Who audits it
- Self
As of .
What it requires
- If you are a data broker conducting business in Texas that meets the revenue thresholds of section 510.003, develop, implement and maintain a comprehensive written information security program with administrative, technical and physical safeguards appropriate for your size, scope and type of business, your resources, the amount of data you store and the need for security and confidentiality of the personal data.
- Designate one or more employees to maintain the program, identify and assess reasonably foreseeable internal and external risks to records containing personal data, train employees and contractors, require employee compliance, and provide discipline for violations.
- Make the program's safeguards consistent with the safeguards for protection of personal data and information of a similar character under the state or federal laws and regulations that apply to you.
- Provide a means for detecting and preventing security system failures.
- Adopt security policies for your employees on the storage, access and transportation of records containing personal data outside your physical business premises.
- Include measures that prevent a terminated employee from accessing records containing personal data.
- Place reasonable restrictions on physical access to records containing personal data, including by storing the records in a locked facility, storage area or container.
- Monitor the program regularly to ensure it operates in a manner reasonably calculated to prevent unauthorized access to or unauthorized use of personal data, and upgrade your information safeguards as necessary to limit that risk.
- Supervise third-party service providers: take reasonable steps to select and retain providers capable of maintaining appropriate security measures, and require them by contract to implement and maintain those measures.
- Review the scope of the program's security measures at least annually and whenever a material change in your business practices may reasonably affect the security or integrity of records containing personal data.
- Document the responsive actions taken in connection with any breach of security, including a post-incident review of each event and the changes made to business practices in response.
- To the extent technically feasible, use secure user authentication, secure access controls, encryption of records that travel across public networks or wirelessly and of personal data stored on laptops or portable devices, system monitoring, current firewall protection and operating system patches, and current malware protection.
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Penalty structure
Business and Commerce Code section 17.47(c): in a proceeding the consumer protection division brings under Subchapter E, Chapter 17, it may request, and the trier of fact may award, a civil penalty to the state of not more than $10,000 per violation. If the act or practice was calculated to acquire or deprive money or other property from a consumer 65 years of age or older, an additional amount of not more than $250,000 may be awarded. Both figures are ceilings, not floors.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 10,000
Who enforces it
Enforcement body
Texas Attorney General: section 510.009 makes a violation of section 510.007 a deceptive trade practice actionable under Subchapter E, Chapter 17 of the Business and Commerce Code, and under that subchapter the consumer protection division of the attorney general's office may bring an action in the name of the state (section 17.47).
What this law does
A data broker conducting business in Texas has a duty to protect the personal data it holds, and must develop, implement and maintain a comprehensive written information security program with administrative, technical and physical safeguards appropriate for its size, scope and type of business, its resources, the amount of data it stores and the need for security and confidentiality. The program must include the designation of one or more employees of the data broker to maintain it.
The program must incorporate safeguards that are consistent with the safeguards for protection of personal data and information of a similar character under state or federal laws and regulations applicable to the data broker. The program must provide a means for detecting and preventing security system failures.
The program must include security policies for the data broker's employees relating to the storage, access and transportation of records containing personal data outside the broker's physical business premises. The program must include measures for preventing a terminated employee from accessing records containing personal data.
The program must provide reasonable restrictions on physical access to records containing personal data, including by requiring the records to be stored in a locked facility, storage area or container. The program must include regular monitoring to ensure that it operates in a manner reasonably calculated to prevent unauthorized access to or unauthorized use of personal data and, as necessary, upgrading information safeguards to limit that risk.
The program must provide policies for supervising third-party service providers, including requiring them by contract to implement and maintain appropriate security measures for personal data. The program's security measures must be reviewed at least annually, and whenever there is a material change in the data broker's business practices that may reasonably affect the security or integrity of records containing personal data.
The program must require documentation of the responsive actions taken in connection with any incident involving a breach of security, including a mandatory post-incident review of each event.
To the extent technically feasible, the program must include secure user authentication protocols, secure access control measures, encryption of transmitted records and of personal data stored on laptop computers or other portable devices, reasonable monitoring of systems, firewall protection and operating system patches, and system security agent software with malware protection.
A violation of section 510.007 by a data broker is a deceptive trade practice actionable under Subchapter E of Chapter 17 of the code. In Chapter 17 of the code, the consumer protection division means the consumer protection division of the attorney general's office. The consumer protection division may bring an action in the name of the state to restrain an act or practice declared unlawful by Subchapter E of Chapter 17 by temporary restraining order or injunction.
In a proceeding under section 17.47(a), the consumer protection division may request, and the trier of fact may award, a civil penalty to the state of not more than $10,000 per violation and, where the act or practice was calculated to acquire or deprive money or other property from a consumer 65 years of age or older, an additional amount of not more than $250,000.
Senate Bill 2105 of 2023 added the duty, and House Bill 1620 of 2025 redesignated it from Chapter 509 to Chapter 510 of the code, effective .
When LexLint raises it
When your app profile says your app tracks devices.