Texas Data Privacy and Security Act (TDPSA) - Compliance Guide

· About Texas Data Privacy and Security Act (TDPSA)

Key Takeaways

  • The Texas Data Privacy and Security Act (TDPSA) applies to entities that do business in Texas or produce products or services targeted to Texas residents and that meet the statute’s size thresholds, while exempt entities include government bodies and several regulated or nonprofit categories.[1][2]
  • TDPSA took effect on 1 July 2024, but the universal opt-out-signal requirement in Tex. Bus. & Com. Code § 541.055(e) became effective on 1 January 2025.[1][2]
  • The Texas Attorney General has exclusive enforcement authority, and TDPSA does not provide a private right of action.[1][2]
  • Before filing suit, the Attorney General must give written notice and allow a 30-day cure period; if a violation is cured and the controller provides no further violation, the AG may not bring an action for that violation.[1][2]
  • The maximum civil penalty is $7,500 per violation, and the AG may recover reasonable expenses, court costs, and attorney’s fees in an action to enforce the statute.[2]
  • In 2025–2026, Texas added and amended adjacent privacy and AI rules, but the TDPSA’s core consumer privacy framework remained in force; controllers should treat these updates as overlapping obligations rather than a TDPSA repeal or delay.[3][4]

What It Is

TDPSA is Texas’s comprehensive consumer privacy law in Chapter 541 of the Texas Business and Commerce Code. It regulates the collection, use, processing, sale, and disclosure of personal data by covered controllers and gives Texas residents rights over their personal data.[1][2]

The law is enforced by the Texas Attorney General, not a sector regulator or private plaintiffs.[1][2] The enrolled bill states that most of the Act took effect on 1 July 2024, with § 541.055(e) taking effect on 1 January 2025.[2] Public guidance from the Texas Attorney General and the Texas Department of Information Resources repeats those dates.[1][3]

A 2025 Texas legislative package also affected the TDPSA’s broader compliance environment, but available official guidance in the materials reviewed does not indicate a postponement of TDPSA’s operative dates.[3][4]

Who Must Comply

TDPSA applies to a controller that conducts business in Texas or produces products or services consumed by Texas residents, if the controller is not a small business as defined by SBA standards and either controls or processes personal data of at least 100,000 consumers or derives a certain percentage of gross revenue from the sale of personal data while controlling or processing data of at least 25,000 consumers.[1][2]

The law has extraterritorial reach in the ordinary state-privacy-law sense: a business need not be headquartered in Texas if it targets Texas residents or conducts business in Texas and meets the threshold criteria.[1][2]

Exemptions cover, among other categories, state agencies and political subdivisions, nonprofit organizations, higher education institutions, financial institutions subject to the Gramm-Leach-Bliley Act, entities and data subject to HIPAA, and certain employment-related and B2B contexts where the statute excludes the relevant data processing activity.[1][2]

Core Requirements

  1. Consumer rights program. Controllers must provide a privacy notice and a mechanism for consumers to exercise rights to confirm processing, access, correct, delete, obtain a portable copy, and opt out of targeted advertising, sale of personal data, and profiling in furtherance of decisions with legal or similarly significant effects.[1][2]
  1. Sensitive-data safeguards. Controllers must obtain consent before processing sensitive data and provide a clear way for consumers to withdraw consent where the law requires consent-based processing.[1][2]
  1. Data minimization and purpose limitation. Controllers must limit collection to what is adequate, relevant, and reasonably necessary for disclosed purposes and must not process personal data for purposes that are neither reasonably necessary nor compatible with the disclosed purposes without new notice and, where required, consent.[1][2]
  1. Privacy notice and transparency. Controllers must publish a reasonably accessible privacy notice describing categories of personal data processed, purposes, how consumers can exercise rights, categories of data shared with third parties, and categories of third parties with whom data is shared.[1][2]
  1. Contracting with processors. Controllers must use contracts that require processors to follow documented instructions, assist the controller in meeting obligations, and allow or restrict audit, deletion, and subcontracting terms consistent with the statute.[1][2]
  1. Universal opt-out signals. Beginning 1 January 2025, controllers must recognize and honor a consumer’s opt-out preference signal through a mechanism such as Global Privacy Control for sale of personal data and targeted advertising when the statute applies.[1][2][3]
  1. Data protection assessments. Controllers must conduct and document data protection assessments for certain high-risk processing activities, including targeted advertising, sale of personal data, sensitive-data processing, profiling, and other processing that presents heightened risk.[1][2]

Deadlines and Penalties

| milestone | date | what applies | |---|---:|---| | TDPSA effective date | 1 July 2024 | Most controller, processor, notice, rights, and assessment obligations became enforceable.[1][2] | | Universal opt-out signal rule effective | 1 January 2025 | Controllers must honor qualifying universal opt-out preference signals for covered activities.[1][2][3] | | Notice-and-cure period | Ongoing | The AG must provide written notice and allow 30 days to cure before suit.[1][2] |

The maximum civil penalty is $7,500 per violation.[1][2] The Attorney General may also recover reasonable expenses, court costs, and attorney’s fees in an enforcement action.[2] TDPSA does not create a private right of action, so consumer lawsuits are not the enforcement mechanism under the statute.[1][2]

How to Comply

  1. Map applicability and exemptions. Confirm whether the entity meets the Texas thresholds, whether the organization is a controller or processor, and whether any data streams are exempt under HIPAA, GLBA, nonprofit, or governmental exclusions.[1][2]
  1. Build a data inventory. Document categories of personal data, sensitive data, processing purposes, disclosures, retention periods, and whether data is sold, used for targeted advertising, or used for profiling.[1][2]
  1. Update notices and rights intake. Align the privacy notice, cookie/consent banner, and rights-request workflow so Texas consumers can exercise access, correction, deletion, portability, and opt-out rights without friction.[1][2]
  1. Refresh processor contracts. Amend vendor agreements to require instructions-based processing, assistance with consumer requests and assessments, confidentiality, deletion, and flow-down obligations.[1][2]
  1. Implement consent and signal handling. Configure systems to capture affirmative consent for sensitive data and to honor universal opt-out signals beginning 1 January 2025 for applicable advertising and sale use cases.[1][2][3]
  1. Run data protection assessments. Use a risk-assessment format consistent with NIST CSF 2.0 for governance and risk management, and align assessment controls with ISO 27001 security controls where they bear on confidentiality, integrity, and access management.[1][2]
  1. Integrate privacy-by-design controls. Where AI or automated decision-making is involved, coordinate TDPSA review with ISO 42001 governance practices so model-use cases, human oversight, and vendor controls are documented before deployment.[3][4]
  1. Maintain an enforcement file. Keep records proving notice content, consent capture, opt-out handling, assessment completion, and remediation steps so a 30-day cure response can be assembled quickly if the Attorney General sends notice.[1][2]

Related Regulations

  • Texas Responsible AI Governance Act (TRAIGA). Texas enacted AI-specific rules in 2025 with 2026 effectiveness dates; those rules do not replace TDPSA, but they can add obligations for AI systems that also process personal data.[3][4]
  • Texas breach notification law. TDPSA sits alongside Texas data-breach notice requirements, so an incident may trigger both consumer privacy analysis and separate breach-notification duties.
  • Virginia Consumer Data Protection Act. Virginia’s law resembles TDPSA on consumer rights and controller obligations, but Texas has its own thresholds, exemption set, and enforcement mechanics.
  • Colorado Privacy Act. Colorado’s regime is a close comparator on targeted advertising, sale, profiling, and universal opt-out handling, but Texas uses different statutory triggers and penalty structure.
  • California Privacy Rights Act. California overlaps on access, delete, correct, and opt-out concepts, but California’s enforcement and private-action ecosystem are materially different from TDPSA.

FAQ

Does TDPSA apply to companies outside Texas?

Yes, if the company conducts business in Texas or produces a product or service consumed by Texas residents and meets the statute’s threshold criteria.[1][2] Physical presence in Texas is not required. The practical test is whether the business is covered by the statute and whether an exemption applies.

Does TDPSA have a private right of action?

No. Enforcement is reserved to the Texas Attorney General, and the statute does not allow consumers to sue directly for a TDPSA violation.[1][2] That makes cure documentation and compliance records especially important because the AG is the only civil enforcer under Chapter 541.[1][2]

When did the universal opt-out requirement start?

The universal opt-out signal requirement in § 541.055(e) became effective on 1 January 2025.[1][2][3] Controllers covered by the statute should have already implemented signal recognition for applicable sale and targeted-advertising use cases.

Does TDPSA require a privacy policy?

Yes. Covered controllers must publish a reasonably accessible privacy notice describing what data is processed, why it is processed, how rights can be exercised, and what categories of third parties receive the data.[1][2] The notice must be operationally accurate, so it should match actual data flows and vendor relationships.

Are employees or B2B contacts covered?

TDPSA contains exclusions for certain employment-related and B2B contexts, so not every personnel or commercial contact record is treated the same as consumer data under the statute.[1][2] Coverage should be analyzed by data type and context, not just by whether the person is a Texas resident.

What happens if the Attorney General sends a notice?

The controller generally has 30 days to cure the alleged violation and avoid an enforcement action if the violation is cured and no further violation occurs.[1][2] That window should be used to document root cause, remediate systems, and preserve evidence of the fix.

Sources

Put it into practice

More compliance guides