Texas Identity Theft Enforcement and Protection Act (TITEPA)

The Texas Identity Theft Enforcement and Protection Act (TITEPA) provides protections against identity theft, requiring businesses to safeguard sensitive personal information and imposing penalties for data breaches.

Analysis

Key Requirements

The Texas Identity Theft Enforcement and Protection Act (TITEPA) imposes several key requirements on businesses operating in Texas:

• Implement and maintain reasonable procedures to protect sensitive personal information from unlawful use or disclosure[](https://www.texasattorneygeneral.gov/consumer-protection/file-consumer-complaint/consumer-privacy-rights/identity-theft-enforcement-and-protection-act)

• Properly dispose of records containing sensitive personal information by shredding, erasing, or otherwise making the information unreadable or indecipherable[](https://www.texasattorneygeneral.gov/consumer-protection/file-consumer-complaint/consumer-privacy-rights/identity-theft-enforcement-and-protection-act)

• Notify affected individuals of a data breach no later than 60 days after determining that a breach occurred[](https://www.smartglobalgovernance.com/en/texas-identity-theft-enforcement-and-protection-act/)

• Report data breaches affecting 250 or more Texas residents to the Texas Attorney General within 30 days of determining a breach occurred[](https://www.texasattorneygeneral.gov/consumer-protection/file-consumer-complaint/consumer-privacy-rights/identity-theft-enforcement-and-protection-act)

• Provide specific information in breach notifications, including a description of the incident, the type of sensitive information compromised, and steps taken to restore security[](https://www.texasattorneygeneral.gov/consumer-protection/file-consumer-complaint/consumer-privacy-rights/identity-theft-enforcement-and-protection-act)

Compliance Challenges

Organizations face several challenges in complying with TITEPA:

• Keeping up with evolving regulations: As privacy laws change, businesses struggle to stay current and adapt their practices[](https://www.indusface.com/blog/compliance-challenges/)

• Resource constraints: Many organizations lack dedicated compliance staff or expertise to fully implement TITEPA requirements[](https://www.indusface.com/blog/compliance-challenges/)

• Data management complexities: Identifying and securing all sensitive personal information across systems can be difficult, especially for larger organizations[](https://www.rrsfirm.com/complying-with-the-texas-identity-theft-enforcement-and-protection-act/)

• Breach detection and response: Detecting breaches quickly and meeting the 60-day notification deadline can be challenging[](https://kirkpatrickprice.com/blog/amendments-to-titepa-breach-notification-and-privacy-in-texas/)

Implementation Best Practices

To effectively implement TITEPA requirements:

• Conduct regular risk assessments to identify vulnerabilities in data protection practices[](https://www.hhs.gov/hipaa/for-professionals/security/guidance/guidance-risk-analysis/index.html)

• Develop and maintain a written information security program outlining policies and procedures for protecting sensitive data[](https://www.ftc.gov/business-guidance/resources/start-with-security-guide-business)

• Implement strong access controls and encryption for sensitive data storage and transmission[](https://www.nist.gov/cyberframework)

• Provide regular employee training on data protection and privacy best practices[](https://www.texasbar.com/AM/Template.cfm?Section=articles&Template=/CM/HTMLDisplay.cfm&ContentID=39991)

• Establish an incident response plan to quickly address and report potential breaches[](https://www.cisa.gov/sites/default/files/publications/Federal_Government_Cybersecurity_Incident_and_Vulnerability_Response_Playbooks_508C.pdf)

Recent Updates

Recent amendments to TITEPA include:

• 60-day breach notification deadline: Effective September 1, 2019, businesses must notify affected individuals within 60 days of determining a breach occurred[](https://kirkpatrickprice.com/blog/amendments-to-titepa-breach-notification-and-privacy-in-texas/)

• Attorney General notification requirement: Also effective September 1, 2019, businesses must notify the Texas Attorney General of breaches affecting 250 or more Texas residents[](https://kirkpatrickprice.com/blog/amendments-to-titepa-breach-notification-and-privacy-in-texas/)

Related Regulations

TITEPA interacts with several other privacy regulations:

• HIPAA: For healthcare providers, TITEPA complements HIPAA requirements for protecting health information[](https://www.simbo.ai/blog/understanding-the-interplay-between-hipaa-and-texas-state-privacy-laws-for-healthcare-providers-2335411/)

• Texas Medical Records Privacy Act (TMRPA): Provides additional protections for health-related information in Texas[](https://compliancy-group.com/texas-medical-privacy-and-identity-theft-protection-acts/)

• CCPA/CPRA: While focused on California, these laws have similar breach notification requirements that may overlap for businesses operating in both states[](https://oag.ca.gov/privacy/ccpa)

Industry Impact

TITEPA has significant impacts across industries:

• Healthcare: Providers must navigate both HIPAA and TITEPA requirements, potentially facing stricter standards and higher penalties[](https://www.simbo.ai/blog/understanding-the-interplay-between-hipaa-and-texas-state-privacy-laws-for-healthcare-providers-2335411/)

• Financial Services: Banks and financial institutions must implement additional safeguards to protect sensitive financial data[](https://www.fdic.gov/resources/supervision-and-examinations/consumer-compliance-examination-manual/documents/10/x-3-1.pdf)

• Retail: Businesses collecting customer data for marketing or sales purposes must ensure proper protection and disposal of personal information[](https://www.ftc.gov/business-guidance/resources/protecting-personal-information-guide-business)

Sources

Texas Attorney General - Identity Theft Enforcement and Protection Act

Smart Global Governance - Texas Identity Theft Enforcement and Protection Act

Indusface - Top 8 Compliance Challenges for Enterprises in 2025

RRS Firm - Complying with the Texas Identity Theft Enforcement and Protection Act

KirkpatrickPrice - Amendments to TITEPA: Breach Notification and Privacy in Texas

HHS - Guidance on Risk Analysis

FTC - Start with Security: A Guide for Business

NIST Cybersecurity Framework

Texas Bar - Cybersecurity for Lawyers

CISA - Incident Response Playbooks

Simbo AI - Understanding the Interplay Between HIPAA and Texas State Privacy Laws

Compliancy Group - Texas Medical Privacy and Identity Theft Protection Acts

California Attorney General - CCPA

FDIC - Privacy of Consumer Financial Information

FTC - Protecting Personal Information: A Guide for Business

Recent developments

• 2025-12-03 — Texas AG clarified via settlement that consent-based text messaging under amended laws (SB 140) does not require registration or bonds, reducing enforcement risks tied to TITEPA privacy protections (source)

Read the full guide to Texas Identity Theft Enforcement and Protection Act (TITEPA)

Related regulations

• Texas Responsible Artificial Intelligence Governance Act (TRAIGA, HB 149) — Texas, Active, effective 2026-01-01
• Texas Data Privacy and Security Act (TDPSA) — Texas, Active, effective 2024-07-01
• Texas App Store Accountability Act (SB 2420) — Texas, Active, effective 2026-01-01
• NYDFS Cybersecurity Regulation — New York, Active, effective 2025-11-01
• Law on Cybersecurity of Vietnam — Vietnam, Active
• Austria NIS2 Act — Austria, Upcoming
• Luxembourg NIS2 Transposition — Luxembourg, Active
• EU Cyber Resilience Act (CRA) — European Union, Phased, effective 2027-12-11

Put it into practice

• Generate the policy: Texas TDPSA policy generator (generatepolicy.com)
• Buy the policy pack: State Privacy Law Checklist (cyberpolicy.shop)
• Build it yourself: 2026 US Privacy Program Workbook (ciso.diy)

Browse all regulations · Compliance deadlines · Latest updates