How fast must a company report a data breach in Texas?

Texas Business & Commerce Code § 521.053

PILOT PROFILELAST VERIFIED · OCT 24 2026

At a glance

Notice to individualsUp to 60 days (to re-check)

Notice to Attorney GeneralWithin 30 days (250+ residents)

StatuteTexas Business & Commerce Code § 521.053

Recent changeAttorney General deadline added by H.B. 3746 (87th Legislature, 2021)

What counts as a breach?

"Breach of system security" means unauthorized acquisition of computerized data that compromises the security, confidentiality or integrity of sensitive personal information, including encrypted data if the person accessing it has the decryption key.

Notice to individuals

After discovering or receiving notice of a breach, notify each individual whose sensitive personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The statute sets an outer limit of 60 days after the breach is determined (re-check the current statute text before relying on this figure).

Notice to the Attorney General

If the breach involves at least 250 Texas residents: notify the Attorney General as soon as practicable and not later than the 30th day after the date the breach is determined.

Notice content and publication

The Attorney General notice has required contents, and the statute directs the Attorney General to maintain a public listing of notified breaches and to update it within 30 days of receiving a new notification.

What changed

H.B. 3746 (2021) added the Attorney General notice duty and listing. The House version proposed 60 days; the version enacted uses 30 days.

Scope of this profile: deadlines for individuals and the Attorney General only. Other duties (consumer reporting agencies, regulators, sector rules such as HIPAA or GLBA, contractual duties) and exemptions are not covered here. In a real incident, confirm against the current statute and get legal advice.

Primary sources and verification

Last verified: October 24, 2026. Pilot profile: the full Research Card v2.1 standard (exemptions, definitions of personal information, enforcement) is still being added.

ALL BREACH NOTIFICATION PROFILES → TEXAS PRIVACY LAW →

Research and educational material only. Not legal advice. Time-sensitive legal requirements should be verified against current authoritative sources.