Texas Identity Theft Enforcement and Protection Act (TITEPA) - Compliance Guide

· About Texas Identity Theft Enforcement and Protection Act (TITEPA)

Key Takeaways

  • The Texas Identity Theft Enforcement and Protection Act (ITEPA), codified in Texas Business and Commerce Code Chapter 521, applies to businesses and other persons handling sensitive personal information and is enforced by the Texas Attorney General.[1][13]
  • Texas requires breach notice to affected individuals without unreasonable delay and no later than 60 days after determining a breach occurred, while notice to the Attorney General is required when at least 250 Texans are affected and must be filed as soon as practicable and no later than 30 days after discovery.[1][2]
  • The Attorney General may seek civil penalties under Texas privacy and breach laws, and Texas also requires disposal of records containing personal information so the information is unreadable or indecipherable.[1][13]
  • ITEPA is not a standalone modern privacy framework; it is the long-running Texas identity-theft and data-security statute, while newer Texas privacy law and breach-notification amendments create separate, overlapping duties.[1][13]
  • For 2026 compliance, the practical risk point is not an uncertain future effective date but enforcement of existing Texas breach-notification and record-disposal duties, including the 30-day Attorney General filing rule.[1][2][6]

What It Is

ITEPA is Texas’s identity-theft and personal-information protection framework, centered in Chapter 521 of the Texas Business and Commerce Code, with provisions on safeguarding sensitive personal information, breach notification, and disposal of records.[1][10][13] The Texas Attorney General publicly describes it as the law that requires businesses to safeguard sensitive personal information, dispose of records so information is unreadable or indecipherable, and report qualifying data breaches.[1][2]

The statute’s original enactment is reflected in the enrolled 2005 legislation adopting Chapter 521 as the “Identity Theft Enforcement and Protection Act.”[10] Subsequent amendments, as reflected in current Texas Attorney General guidance and Texas legal analyses, include the 2012 HB 300 changes to the broader Texas privacy framework and the 2020 and 2023 updates to breach-notification rules, including the Attorney General notice deadline now in force.[1][5][6]

The key phase-in milestone still relevant today is the 1 September 2023 effective date for the shortened Attorney General breach-notice deadline and electronic filing requirement, which replaced the prior 60-day notice window to the Attorney General.[6] As of 6 September 2026, no later Texas amendment identified in the available sources has delayed or replaced that rule.[1][2][6]

Who Must Comply

ITEPA applies broadly to businesses and organizations that own, license, maintain, manage, or otherwise handle computerized data containing sensitive personal information affecting Texans, including persons outside Texas when they process Texas residents’ information or handle data owned or stored in Texas.[1][3][4] Texas Attorney General guidance frames the breach obligation around breaches affecting Texans and the organization’s role in the data, not merely the organization’s home state.[1][2]

The law’s breach-notification trigger is the compromise of “sensitive personal information,” a term Texas uses for personal data that can facilitate identity theft, such as combinations involving names plus identifiers or account data.[1][14] Texas breach notice to the Attorney General is required only if the breach affects at least 250 Texas residents, while individual notice is required for affected persons whose sensitive personal information was acquired or reasonably believed to have been acquired by an unauthorized person.[1][3]

The available sources do not identify a broad corporate-size threshold, and the regime is not limited to large companies.[1][2] Public-sector entities, financial institutions, and other organizations may also face separate sectoral regimes, but Texas’s Chapter 521 obligations still operate as the baseline state breach and disposal framework where applicable.[1][13]

Core Requirements

  1. Safeguard sensitive personal information. Businesses must maintain reasonable protections for sensitive personal information and prevent unauthorized acquisition that compromises security, confidentiality, or integrity.[1][13]
  1. Notify affected individuals promptly. If a breach involves sensitive personal information, the business must notify affected individuals without unreasonable delay and no later than 60 days after determining the breach occurred.[1][6]
  1. Notify the Texas Attorney General for large breaches. If a breach affects 250 or more Texans, the business must file notice with the Texas Attorney General as soon as practicable and no later than 30 days after discovery, using the electronic form required by Texas law and AG guidance.[1][2][6]
  1. Provide the required breach details. The Attorney General notice must include the information Texas requires, including the nature of the breach, number of affected residents, measures taken, intended response measures, and whether law enforcement is investigating.[5][9]
  1. Dispose of records securely. When disposing of records containing personal information, the disposal process must render the information unreadable or indecipherable.[1]
  1. Preserve identity-theft victim rights. Texas law gives victims certain limited rights, including the ability to seek a district court declaration that they are a victim of identity theft.[1]

Deadlines and Penalties

| milestone | date | what applies | |---|---:|---| | Original enactment of Chapter 521 | 2005 | Chapter 521 was enacted as the Identity Theft Enforcement and Protection Act.[10] | | Breach notice amendment effective | 1 September 2023 | Attorney General notice deadline changed to as soon as practicable and no later than 30 days after discovery.[6] | | Current individual notice deadline | ongoing | Affected individuals must be notified without unreasonable delay and no later than 60 days after determining the breach occurred.[1][6] | | Current AG notice trigger | ongoing | Notice to the Attorney General is required when at least 250 Texas residents are affected.[1][2] |

Texas guidance and legal commentary indicate the Attorney General has enforcement authority and may pursue civil penalties, injunctive relief, and related remedies under Texas privacy and breach laws.[1][13] A commonly cited civil-penalty ceiling for Texas privacy enforcement is up to $7,500 per violation, although the exact exposure depends on the provision violated and the enforcement theory used.[6][13]

Other sanctions can include injunctive relief, compliance orders, attorney’s fees and costs in some actions, and reputational harm from Texas’s public breach-listing practice for Attorney General notifications.[5][6] Separate criminal or private-remedy consequences may also arise under other Texas or federal laws depending on the facts, but those are not specific to ITEPA itself.[1][13]

How to Comply

  1. Map data and classify sensitive personal information. Build an inventory of where Texans’ sensitive personal information is collected, stored, transmitted, and disposed of, and tie each dataset to business owners and processors. ISO 27001 maps well here because it requires an information-security management system, asset inventory, and risk treatment discipline.
  1. Set a Texas breach-response playbook. Define “discovery,” triage criteria, legal review, and notification decision points so the 30-day Attorney General clock and 60-day individual clock are never missed. NIST CSF 2.0 fits this work because its Govern, Identify, Protect, Detect, Respond, and Recover functions align with incident handling.
  1. Implement notice workflows and evidence capture. Pre-draft Texas-specific individual and Attorney General notices, keep a decision log, and preserve facts needed for the Texas reporting form. This is operational control work rather than a certification exercise.
  1. Harden disposal and retention controls. Make secure destruction mandatory for paper, media, and backups containing personal information, and verify that disposal renders the data unreadable or indecipherable.[1] ISO 27001 controls on media handling and retention support this requirement.
  1. Align security governance with board oversight. Assign ownership for Texas obligations, review breach metrics, and test escalation paths at least annually. NIST CSF 2.0 and ISO 27001 both support governance and continuous improvement.
  1. Use privacy-by-design for new products. Minimize sensitive personal information, encrypt where feasible, restrict access, and document lawful retention periods. ISO 42001 is most relevant if AI systems process personal data, because it adds management-system controls for AI lifecycle governance.
  1. Test incident response with Texas scenarios. Run tabletop exercises that include a 250-resident breach, third-party compromise, and delayed forensic confirmation so counsel can evaluate notice triggers quickly. Keep proof of exercises and lessons learned.

Related Regulations

Texas Data Privacy and Security Act: This newer law overlaps with ITEPA on governance and Attorney General enforcement but is a separate consumer-privacy regime with broader privacy-rights obligations.[13]

Health Insurance Portability and Accountability Act: HIPAA can preempt or supplement Texas requirements for covered entities and business associates, but Texas breach and disposal rules may still matter depending on the data and entity type.[1][13]

Gramm-Leach-Bliley Act: Financial institutions may follow federal GLBA safeguards and breach rules, yet Texas notice obligations can still apply to certain Texas resident data incidents.[1][13]

California Consumer Privacy Act: CCPA is broader on consumer rights and privacy notices, but Texas is narrower and centers more on breach notification and personal-data disposal.[1][13]

Federal Trade Commission Act: FTC enforcement for unfair or deceptive practices can overlap with weak security or inaccurate privacy representations, creating parallel exposure beyond Texas state law.[13]

FAQ

Does ITEPA apply to companies outside Texas?

Yes. Texas guidance and commentary indicate the law can reach businesses outside Texas when they handle sensitive personal information owned or stored in Texas or when Texas residents are affected by a breach.[1][4] The practical trigger is the handling of Texas-related data, not the company’s headquarters.

Do all breaches have to be reported to the Texas Attorney General?

No. Texas Attorney General notice is required when a breach affects at least 250 Texas residents.[1][2] Smaller breaches may still require individual notice if sensitive personal information was acquired or reasonably believed to have been acquired by an unauthorized person.[1][6]

How fast must a Texas breach be reported?

Affected individuals must be notified without unreasonable delay and no later than 60 days after determining the breach occurred.[1][6] If the breach affects at least 250 Texans, the Attorney General notice must be filed as soon as practicable and no later than 30 days after discovery.[1][2][6]

What counts as sensitive personal information?

Texas uses the term for information that can enable identity theft or unauthorized access, commonly including combinations of personal identifiers with Social Security, driver’s license, account, or related data elements.[1][14] The exact legal definition should be checked in Chapter 521 for the incident type at issue.

Is there a private right of action under ITEPA?

The available Texas Attorney General materials emphasize administrative enforcement and limited victim rights, including a court declaration for identity-theft victims.[1] Enforcement exposure is therefore primarily regulatory, although other laws can create private claims on the same facts.

Were there 2025 or 2026 amendments delaying the Texas breach rules?

No delaying amendment is identified in the sources reviewed for 2025 or 2026.[1][2][6] The current Attorney General deadline remains the 30-day rule that became effective on 1 September 2023.[6]

Sources

Put it into practice

More compliance guides