Law / United States / 
Texas
Texas Data Privacy and Security Act, consumer rights and assessments
Tex. Bus. & Com. Code secs. 541.051-541.053, 541.105
In force since .
A data subject rights rule binding private bodies.
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
What it requires
- Give a Texas consumer a means to confirm whether you process their personal data, access it, correct it, delete it, and receive a portable copy.NIST Privacy FrameworkCT.PO-P3
- Offer a Texas consumer an opt-out of targeted advertising, the sale of personal data, and profiling that produces a legal or similarly significant effect.NIST Privacy FrameworkCT.PO-P3
- Respond to a consumer rights request without undue delay and no later than 45 days after receipt, with one 45-day extension available, and respond to an appeal of a refusal within 60 days.NIST Privacy FrameworkCT.PO-P3NIST Privacy FrameworkGV.MT-P7
- Conduct and document a data protection assessment before targeted advertising, sale of personal data, certain profiling, or sensitive-data processing.NIST Privacy FrameworkID.RA-P4
These lines are LexLint's reading of the law's text. Also read by: Office of the Texas Attorney General (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- ID.RA-P4Problematic data actions, likelihoods, and impacts are used to determine and prioritize risk.
- GV.MT-P7Policies, processes, and procedures for receiving, tracking, and responding to complaints, concerns, and questions from individuals about organizational privacy practices are established and in place.
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://www.texasattorneygeneral.gov/consumer-protection/file-consumer-complaint/consumer-privacy-rights/texas-data-privacy-and-security-act
- Guidance body
- Office of the Texas Attorney General
- Open questions
- Which processing activities other than targeted advertising, sale, certain profiling and sensitive-data processing present 'a heightened risk of harm to consumers' that requires a data protection assessment under Section 541.105(a)(5)?
What it makes you log
Who may demand the log
Regulator
What the log must hold
Decision basis
Logging duty
A controller must conduct and document a data protection assessment of targeted advertising, sale of personal data, risky profiling, sensitive-data processing and any processing that presents a heightened risk of harm (541.105(a)). The assessment must weigh the benefits of the processing against the risks to the consumer, as mitigated by safeguards (541.105(b)), and the controller must make an assessment the Attorney General requests available on a civil investigative demand (541.105(c)); the Attorney General's power to request and evaluate it is in 541.153(b), which this row does not cite. The Act sets no period for keeping an assessment, and 541.105(d) makes it confidential. The response and appeal sections (541.051 to 541.053) require the controller to tell the consumer why it declined a request (541.052(c)) and to give a written explanation of an appeal decision (541.053(c)); those are communications to the consumer and name no record. The record of a deletion request in 541.052(f) is one of two routes to compliance, so it is an option and not a duty. The controller bears the burden of showing a request is manifestly unfounded, excessive or repetitive (541.052(d)), which allocates proof of a fee or refusal and is not a record duty. The sections cited have no scope clause; the business-reach prong is in 541.002(a) and the consumer definition in 541.001(7), neither cited here.
- Kind
- Explicit
- As of
- Provision
- Tex. Bus. & Com. Code sec. 541.105(a)-(c) (documented data protection assessments)
- Trigger
- personal_data_processing
What this law does
TDPSA gives a Texas consumer the right to confirm and access their personal data, correct inaccuracies, delete data, obtain a portable copy, and opt out of targeted advertising, the sale of personal data, and profiling that produces a legal or similarly significant effect, exercisable against the controller.
A controller must respond without undue delay and no later than 45 days after receipt, with one 45-day extension available, must answer an appeal of a refusal within 60 days, and must conduct and document a data protection assessment before targeted advertising, sale, certain profiling, sensitive-data processing, or other heightened-risk processing.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions or processes personal data.
Back to the example · Lint your app
Page updated .