Law / United States / 
Texas
Texas Data Privacy and Security Act, Attorney General enforcement
Tex. Bus. & Com. Code secs. 541.151, 541.154-541.156
In force since .
An enforcement supervision rule binding private bodies.
- Private right of action
- No
- Audit expectation
- none
What it requires
- Expect TDPSA violations to be enforced exclusively by the Texas Attorney General, never by a private plaintiff.
- Cure a violation and confirm the cure in writing within 30 days of Attorney General notice to avoid a civil penalty of up to $7,500 per violation.
- Do not treat the absence of individual lawsuits as low risk. The Attorney General is actively litigating a TDPSA enforcement action over data sales through embedded SDKs.
These lines are LexLint's reading of the law's text. Also read by: Office of the Texas Attorney General (guidance, recorded ).
Who enforces it
Settledness
- As of
- Guidance link
- https://www.texasattorneygeneral.gov/consumer-protection/file-consumer-complaint/consumer-privacy-rights/texas-data-privacy-and-security-act
- Guidance body
- Office of the Texas Attorney General
- Open questions
- Does 'each violation' in Section 541.155(a) count each affected consumer, each unanswered request or each unlawful processing activity when the Attorney General seeks a civil penalty of up to $7,500?
What it makes you log
Logging duty
The cited sections give the Attorney General exclusive enforcement authority (541.151), a 30-day notice and cure period (541.154), a civil penalty of up to $7,500 per violation with injunctive relief (541.155) and no private right of action (541.156). None requires a record. To cure, a person gives the Attorney General a written statement with supportive documentation (541.154(2)); that is a condition of avoiding an action and not a standing record. The power to demand a data protection assessment by civil investigative demand is in 541.153(b) and the controller's duty to produce it in 541.105(c), neither cited by this row. The sections have no scope clause.
- Kind
- None
- As of
What this law does
The Texas Attorney General has exclusive authority to enforce TDPSA. Before suing, the Attorney General must give an alleged violator 30 days' written notice identifying the specific provisions violated; curing the violation within that period and confirming the cure in writing bars the action. An uncured violation is subject to a civil penalty of up to $7,500 per violation, and the chapter expressly bars any private right of action.
The Attorney General filed the state's first TDPSA enforcement action against Allstate Corp. and Arity LLC on , over the sale of geolocation and driving-behavior data collected through SDKs embedded in third-party apps, and that case remains pending.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .