Texas Data Privacy and Security Act (TDPSA) Compliance: What Texas Businesses Need to Know

November 15th, 2026

The Texas Data Privacy and Security Act (TDPSA) took effect on July 1, 2024, and it is not only a concern for large technology companies. The law reaches many for-profit businesses that serve Texas residents, and the Texas Attorney General has already begun enforcing it. For a small or mid-sized business, the practical question is not whether privacy matters. It is whether the business is covered, what it must do, and which technical controls make compliance possible.

This article explains the main requirements in plain language and outlines a practical compliance path. It is general information, not legal advice. Coverage and obligations depend on the business's industry, data, vendors, and contracts, so the final decisions should involve qualified Texas counsel.

What the TDPSA Does

The TDPSA gives Texas consumers rights over their personal data and places duties on businesses that control or process it. It follows the general shape of other state privacy laws, with Texas-specific definitions and enforcement. The law is codified in Chapter 541 of the Texas Business and Commerce Code.

Unlike some state privacy laws, the TDPSA has no revenue threshold and no minimum number of consumers. A business does not become covered simply by growing large enough to cross a dollar line. Coverage depends on what the business does with personal data and whether it qualifies for an exemption.

Who Is Covered

The TDPSA generally applies to a person who conducts business in Texas or produces a product or service consumed by Texas residents, processes or engages in the sale of personal data, and is not a small business as defined by the U.S. Small Business Administration (SBA). The SBA definition varies by industry and is based on employees or annual receipts, so the analysis is not a single headcount test.

Several categories are exempt or partially exempt, including state agencies, financial institutions subject to the Gramm-Leach-Bliley Act, covered entities and business associates under HIPAA, nonprofit organizations, institutions of higher education, and certain data governed by other laws. Employment records and business-to-business contact data are generally outside the law's consumer definition, but that does not make them risk-free. Other laws, contracts, and industry rules may still apply.

Small businesses receive significant relief, but the relief is not absolute. A small business may not sell sensitive personal data without first obtaining the consumer's consent. That exception matters for businesses whose websites send data to advertising technology, analytics, or data brokers.

The Rights Texas Consumers Can Exercise

The TDPSA gives consumers the right to:

• Confirm whether a business is processing their personal data and access that data.
• Correct inaccurate personal data.
• Delete personal data.
• Obtain a portable copy of personal data they provided.
• Opt out of the sale of personal data.
• Opt out of targeted advertising.
• Opt out of profiling that produces legal or similarly significant effects.

A covered business must provide at least two secure and reliable methods for submitting requests, respond within 45 days, and may extend the response by another 45 days when reasonably necessary and with notice. Consumers may make two free requests in a 12-month period. The business must also provide an appeal process and decide appeals within 60 days.

The law prohibits retaliating against a consumer for exercising these rights. A business may not deny service, charge a different price, or provide a lower quality of service because someone made a privacy request. Offering a financial incentive with proper consent is a separate question and should be reviewed carefully.

What Covered Businesses Must Do

Publish a compliant privacy notice

The notice must describe the categories of personal data collected, the purposes of processing, the categories of third parties that receive the data, and how consumers can exercise their rights. It must be reasonably accessible and written in clear language. A business that sells sensitive personal data must include the prescribed notice language required by the statute.

Limit collection and use

Personal data must be adequate, relevant, and reasonably necessary for the purposes disclosed. The business must not collect or process data for unrelated purposes without a lawful basis. Data minimization is both a legal requirement and a security control: data that is never collected cannot be leaked.

Maintain reasonable security

The TDPSA requires administrative, technical, and physical safeguards appropriate to the volume and sensitivity of the data. In practice, that means access controls, multi-factor authentication, patching, endpoint protection, logging, backup, vendor management, and an incident response plan. The standard is reasonableness, not perfection, but a business cannot claim compliance while leaving basic controls undone.

Obtain consent for sensitive data

Sensitive data requires the consumer's affirmative consent before processing. Consent must be voluntary, specific, informed, and unambiguous. Passive acceptance of broad terms or a pre-checked box is not enough.

Manage processors with written contracts

A processor is a vendor that handles personal data on the controller's behalf. The TDPSA requires a binding contract that sets out the processing instructions, the nature and purpose of the processing, the types of data, the duration, confidentiality obligations, and how data is returned or deleted at the end of the relationship. The processor must also help the controller meet its security and consumer-request duties.

Conduct data protection assessments

Covered businesses must document assessments for processing that presents heightened risk, including targeted advertising, the sale of personal data, certain profiling, and the processing of sensitive data. The assessment should identify the benefits and risks of the processing and the safeguards used to reduce them. The Attorney General may request these records.

Honor universal opt-out signals

Since January 1, 2025, covered businesses must recognize universal opt-out mechanisms, including the Global Privacy Control (GPC) signal, as a valid request to opt out of sale and targeted advertising. Logging the signal is not enough. The business must suppress the relevant data sharing or advertising activity.

Sensitive Data: A Higher Standard

TDPSA defines sensitive data to include racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, citizenship or immigration status, genetic or biometric data processed for unique identification, personal data collected from a known child, and precise geolocation. Processing any of these categories requires consent before collection.

For a healthcare clinic, a school, a staffing agency, or any business that collects precise location data, this is often the highest-risk part of the statute. The data may be collected by a vendor's software development kit or a marketing tag rather than by the business directly. The business still needs to know it is happening.

Websites, Cookies, and Marketing Technology

Most privacy problems start on the website. Analytics platforms, advertising pixels, chat widgets, and embedded media can transmit personal data to third parties. Some of those transfers may qualify as a sale or as targeted advertising under the statute. A business should inventory the tags on its site, understand what each one collects, and configure consent or suppression where required.

The privacy notice should match what the site actually does. A policy that says the business does not sell data, while a pixel sends email addresses and browsing behavior to an ad platform, is a compliance problem waiting to be discovered.

Vendors, Contracts, and AI

Privacy compliance is largely vendor management. Ask every processor whether it can support the TDPSA's contract terms, security requirements, deletion obligations, and consumer-request workflow. Ask where data is stored, who can access it, how it is encrypted, and how the vendor notifies the business of a breach.

A 2025 amendment in HB 149, part of the Texas Responsible Artificial Intelligence Governance Act (TRAIGA), added duties for processors that handle personal data through AI systems, effective January 1, 2026. The practical takeaway is that AI tools used for customer support, marketing, hiring, or analytics need the same vendor review as any other system that touches personal data.

A separate 2025 law, SB 2610, created a cybersecurity safe harbor for certain businesses that maintain an industry-recognized security program. It addresses breach litigation under a different chapter of the Texas Business and Commerce Code and does not replace the TDPSA's privacy obligations. The two should be read together, not instead of each other.

Enforcement and Penalties

The Texas Attorney General has exclusive enforcement authority. Consumers cannot sue under the TDPSA. Before bringing an action, the Attorney General must give written notice of the alleged violation and allow 30 days to cure. The cure period has no sunset date. A cure requires a written statement describing the corrective action and confirming that the violation will not recur.

If the violation is not cured, or if the business violates its written statement, the Attorney General may seek civil penalties of up to $7,500 per violation, plus investigation costs. In January 2025, the Attorney General filed suit against Allstate and Arity over the collection and sale of driving and location data, which shows that enforcement is not theoretical.

A Practical Compliance Checklist

1. Map personal data. List what the business collects, where it is stored, who can access it, and which vendors receive it.
2. Classify sensitive data. Identify health, biometric, geolocation, immigration, and child data, including data collected indirectly by website tags.
3. Review the privacy notice. Make sure it describes actual practices and includes the required opt-out and sensitive-data language.
4. Build a request process. Provide at least two methods, document identity verification, and track the 45-day clock and appeals.
5. Fix vendor contracts. Add TDPSA-compliant processor terms, security requirements, breach notification, and deletion obligations.
6. Audit website tags. Inventory cookies and pixels, configure consent, and honor the Global Privacy Control signal.
7. Harden security. Enforce multi-factor authentication, patch systems, protect endpoints, back up data, and test recovery.
8. Train employees. Staff need to recognize a privacy request and know where to send it.
9. Set retention and deletion rules. Keep data only as long as needed and delete it reliably across systems and backups.
10. Document decisions. Keep assessments, policies, training records, and vendor reviews where they can be produced on request.

How Managed IT and Cybersecurity Support TDPSA Compliance

Legal counsel can interpret the statute and review the privacy notice. The technical work is where an IT partner helps: identity and access management, multi-factor authentication, endpoint protection, email security, patch management, logging, backup, vendor inventory, and a tested incident response plan. Those controls support the TDPSA's security requirement and make the rest of the compliance program credible.

HTS Voice & Data Systems provides managed IT and cybersecurity services to businesses across Central and South Texas. If you are not sure where your data lives or which vendors can access it, call (210) 495-5520 or contact us to start with an inventory and a security review.

Posted in: Cybersecurity