Texas Data Privacy and Security Act (TDPSA)

The Texas Data Privacy and Security Act (TDPSA) establishes requirements for businesses to protect personal data, notify individuals in the event of a breach, and comply with specific data protection standards, particularly for sensitive data.

Analysis

The Texas Data Privacy and Security Act (TDPSA) is a comprehensive data privacy law that will take effect on July 1, 2024. Here are key details about the TDPSA:

1. Key Requirements and Scope

• Applies to businesses that conduct business in Texas or produce products/services consumed by Texas residents, and process or sell personal data[1][2]
• Covers nearly all consumer-facing companies, regardless of size or revenue[10]
• Defines personal data broadly as information linked or reasonably linkable to an identified or identifiable individual[1]
• Grants consumers rights including access, deletion, correction, portability, and opt-out of sale/targeted advertising[5]
• Requires opt-in consent for processing sensitive data[6]
• Mandates data protection assessments for certain processing activities[5]
• Prohibits discrimination against consumers exercising their rights[6]

2. Implementation Guidelines

• Conduct data mapping and inventory of personal data collected/processed[2]
• Update privacy policies to reflect TDPSA requirements[2]
• Implement processes to handle consumer rights requests within 45 days[6]
• Establish contracts with third-party data processors[5]
• Conduct data protection assessments for high-risk processing[7]
• Implement reasonable security measures to protect personal data[6]
• Provide at least two methods for consumers to submit requests[6]

3. Recent Updates or Changes

• The TDPSA was enacted on June 18, 2023[1]
• Most provisions take effect July 1, 2024[1]
• Provisions related to universal opt-out mechanisms take effect January 1, 2025[5]

4. Industry Impact and Challenges

• Construction industry: B2C companies need to assess data collection practices, update policies, and implement consumer request processes[7]
• Challenges include conducting comprehensive data assessments, updating vendor contracts, and training employees on new procedures[7]
• Potential for significant financial penalties and reputational damage for non-compliance[7]

5. Best Practices for Compliance

• Perform a comprehensive data privacy assessment[7]
• Review and update privacy policies and notices[7]
• Implement processes for handling consumer rights requests[7]
• Conduct data protection assessments for high-risk activities[7]
• Review and update contracts with third-party data processors[7]
• Train employees on new data handling procedures[7]
• Maintain data minimization practices[6]
• Implement reasonable security safeguards[6]
• Ensure transparency in data collection and processing[6]

6. Related Regulations and Standards

• California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA)[1]
• Virginia Consumer Data Protection Act (VCDPA)[1]
• Children's Online Privacy Protection Act (COPPA) for processing children's data[6]
• Businesses compliant with CCPA/CPRA may be well-positioned for TDPSA compliance, but should review specific TDPSA requirements[10]

The TDPSA represents a significant shift in data privacy regulation for Texas, with broad applicability and stringent requirements for businesses handling consumer data. Companies operating in or serving Texas residents should carefully review the law's provisions and take proactive steps to ensure compliance before the July 2024 effective date.

Recent developments

• 2026-06-05 — Analysis of how the TDPSA’s security, data minimization, and consumer-rights requirements are driving intensified Texas AG probes into cybersecurity and data protection practices, signaling more aggressive enforcement across industries.[9] (source)
• 2026-02-22 — Overview of Texas privacy and cybersecurity developments highlighting the TDPSA’s role in a broader 2025–2026 regulatory push, with expectations of continued active enforcement and scrutiny of data collection from vulnerable populations.[3] (source)
• 2026-01-01 — Starting January 1, 2026, TDPSA-related rules enable private rights of action against non-compliant mobile app developers and app stores under Texas App Store Accountability provisions[6]. (source)
• 2025-12-31 — Texas App Store Law, linked to HB 4 (TDPSA), faces a First Amendment lawsuit ahead of its January 1, 2026 enforcement, while TDPSA itself is noted for increasing transparency without restricting freedoms[8]. (source)
• 2025-12-15 — Update noting the TDPSA’s general effectiveness from 2024-07-01 and the 2025-01-01 start date for recognizing universal opt-out mechanisms (e.g., Global Privacy Control), with practical compliance guidance for businesses and discussion of industry readiness.[4] (source)
• 2025-12-10 — Detail on TDPSA timing and scope, emphasizing that global/third‑party opt‑out rights became operative on 2025-01-01 and explaining operational impacts on controllers and processors doing business in Texas.[2] (source)
• 2024-07-15 — Texas State Law Library spotlight summarizing TDPSA’s July 1, 2024 effective date, key consumer rights (access, correction, deletion, opt‑out) and future effective date of Section 541.055(e) on authorized agent requests (2025-01-01), used by practitioners for statutory interpretation and public education.[5] (source)
• 2024-07-01 — Client alert on TDPSA’s go‑live date, stressing its broad applicability (no data/turnover thresholds, focus on non‑small businesses) and outlining core controller obligations such as data minimization and new consumer rights, with commentary on expected compliance burdens.[8] (source)
• 2024-07-01 — Texas Attorney General consumer‑facing TDPSA page explaining residents’ new rights (know, access, correct, delete, opt‑out) and providing an online complaint mechanism, signaling the enforcement framework and informing industry about practical exposure to AG actions.[1] (source)
• 2024-06-25 — Law firm commentary on TDPSA’s final legislative text, including expanded definition of personal data, disclosure requirements for sales of sensitive/biometric data, and consent duties for small businesses, with analysis of how these provisions alter prior compliance expectations.[6] (source)
• 2023-06-20 — Insight alert on the enactment of TDPSA describing its comprehensive nature, controller transparency obligations, and alignment with other US state privacy regimes, and previewing anticipated operational and governance impacts for companies serving Texas residents.[7] (source)
• 2023-06-19 — Initial industry reaction piece explaining TDPSA’s main requirements, comparing it to other state privacy laws, and highlighting likely impacts on ad tech, data brokers, and consumer‑facing businesses operating in or targeting Texas.[4] (source)

Enforcement actions

Read the full guide to Texas Data Privacy and Security Act (TDPSA)

Related regulations

• Texas Responsible Artificial Intelligence Governance Act (TRAIGA, HB 149) — Texas, Active, effective 2026-01-01
• Texas App Store Accountability Act (SB 2420) — Texas, Active, effective 2026-01-01
• UK Data Protection Act 2018 — United Kingdom, Active
• General Data Protection Law (LGPD) — Brazil, Active, effective 2020-09-18
• COPPA (Children's Online Privacy Protection Act) — United States, Active
• Oregon Consumer Privacy Act (OCPA) — Oregon, Active, effective 2024-07-01
• Montana Consumer Data Privacy Act (MCDPA) — Montana, Active, effective 2024-10-01
• New Hampshire Privacy Act (NHPA) — New Hampshire, Active, effective 2025-01-01

Put it into practice

• Generate the policy: Texas TDPSA policy generator (generatepolicy.com)
• Buy the policy pack: State Privacy Law Checklist (cyberpolicy.shop)
• Build it yourself: 2026 US Privacy Program Workbook (ciso.diy)

Browse all regulations · Compliance deadlines · Latest updates