TEXAS · STATE RESEARCH PROFILETexas Data Privacy and Security Act
TDPSA · Normalized Research Card v2.1
IN FORCELAST VERIFIED · AUG 26 2026At a glance
Who must comply?
Applicability model: Small-business exclusion model.
Core threshold: No classic consumer-count threshold; small businesses under the federal SBA definition are generally exempt, except for sale of sensitive data without consent
Applicability remains subject to statutory entity, data-level and activity-specific exemptions. Employment/B2B treatment and federal-law carve-outs should be read together with the official statute linked below.
Consumer rights
| Right / protection | Status |
|---|---|
| Know / access | ✓ Included / qualified by statute |
| Correction | ✓ Included / qualified by statute |
| Deletion | ✓ Included / qualified by statute |
| Portability | ✓ Included / qualified by statute |
| Opt-out targeted advertising | ✓ Included / qualified by statute |
| Opt-out sale | ✓ Included / qualified by statute |
| Opt-out qualifying profiling | ✓ Included / qualified by statute |
Sensitive data & minors
Sensitive-data standard: Consent required; small-business exception still applies to sale of sensitive data
Sensitive data includes personal data of a child under 13; consent must meet the statute's standard.
Business obligations
Reasonable security, processor contracts, privacy notices, sensitive-data consent and data protection assessments for heightened-risk processing.
Enforcement
Authority: Texas Attorney General
Private right of action: No
Penalty / remedy baseline: Up to $7,500 per violation after the cure process / breach of cure statement
What makes Texas different?
Texas is one of the clearest departures from the common consumer-count model. Coverage turns principally on whether an entity is a qualifying small business, making entity classification central to applicability.
Developments to watch
The Attorney General provides a dedicated complaint route and compliance overview.
Editorial rule: future-effective, proposed and pending measures are kept separate from current law.
Primary sources & verification
Last verified: August 26, 2026
Research standard: primary official sources prioritized; official guidance used to explain operational requirements.