TEXAS DATA LAW
An informational publication about data, privacy, information governance, and the information lifecycle, with Texas law first.
A short usage-oriented paragraph, borrowed in function from the IP architecture: it explains how to use the site (browse by topic, read a Guide, search the full library, follow enforcement in the Tracker) rather than describing what the Guides contain. Third person. It points new readers to the question list as the fastest entry point.
What Do You Need to Know?
- Does the Texas privacy law apply to a business without a revenue threshold?
- Which rights does the TDPSA give consumers, and how does a company handle their requests?
- When is sensitive-data consent required?
- Which privacy notices must a Texas business publish, and how must it handle opt-out signals?
- How should a company determine what information it holds?
- Which records should be retained, archived, or deleted?
- What changes when a vendor uses data for its own purposes?
- When does a security incident trigger Texas notice?
- How can a privacy or encryption promise create litigation risk?
- Which rules govern children and age checks?
- When may health or genomic data cross a border?
- Which other-state privacy laws reach a Texas business?
- What does an Attorney General investigation require a company to preserve?
- What must a Texas business do before sharing data with a foreign vendor or a country of concern?
Topics
Texas Privacy Statutes
This hub explains the Texas statutes that create the everyday privacy duties of a Texas organization, with the Texas Data Privacy and Security Act as the center of gravity. It maps who the Act reaches and who it leaves a...
Enforcement and Litigation
This hub covers how Texas privacy law is enforced and how disputes are litigated. At its center is the Attorney General's data privacy and security enforcement program: civil investigative demands under Business and Comm...
Children Teens and Age Verification
This hub separates the overlapping regimes that govern children, teenagers, and age verification for Texas organizations. It starts with federal law: COPPA's operator duties, actual-knowledge standard, parental consent, ...
Sensitive and Sector Data
This hub keeps distinct regimes apart when they govern the same dataset. It compares the TDPSA's sensitive-data category with the Capture or Use of Biometric Identifier Act's biometric identifiers under § 503.001, includ...
Security Incidents and Breach Response
This hub covers how a Texas organization prevents, manages, and reports security incidents. It begins with reasonable security duties under Business and Commerce Code chapter 521 and the cybersecurity safe harbor in chap...
Data Governance and the Information Lifecycle
This hub treats data as an organizational asset that needs ownership, discipline, and a managed end of life. It starts with governance: decision rights, data owners and stewards, proportionate operating models for small ...
Vendors Data Sharing and Transactions
This hub covers what happens when data leaves the organization that collected it. It starts with processing roles: distinguishing processors from controllers and independent third parties by the actual processing relatio...
Federal Multistate and Cross Border Rules
This hub addresses the law outside Texas that still reaches a Texas organization. It begins with the federal sectoral landscape: the FTC Act's Section 5 authority in 15 U.S.C. § 45, COPPA, HIPAA, GLBA, the FCRA, the Stor...
Government Data Records and Access
This hub covers the data of and held by Texas government. It explains the Texas Public Information Act in Government Code chapter 552: what counts as public information, possession or control, exceptions including the pr...
Guides
Planning outlines for 45 guides across nine topic hubs.
Which Data Laws Apply to a Texas Organization
Which of the many data laws that touch a Texas business actually reach yours, and in what order to read them.
TDPSA Duties and Data Protection Assessments
The Texas Data Privacy and Security Act in one reference: who is covered, what controllers and processors owe, and how it is enforced.
Consumer Rights Requests and Opt Out Signals
How a Texas organization receives, verifies, fulfills, and documents consumer rights requests and opt-out signals.
Privacy Notices Consent and Loyalty Programs
What Texas law requires privacy notices to say, how consent must be designed and evidenced, and how loyalty and renewal programs change the analysis.
Texas Data Brokers and Their Supply Chains
Who counts as a data broker in Texas, what chapter 510 requires, and how broker data flows through supply chains.
Attorney General Enforcement and Investigations
How the Texas Attorney General investigates and enforces data laws, how to respond to a CID, and what the enforcement record shows.
Insights
Shorter analyses of new developments, planned from the insight bank.
What the Texas Cybersecurity Safe Harbor Requires a Business to Prove
Eligibility, program evidence, and the limits of the exemplary-damages protection
The Texas Data Broker Code Number Has Changed
Redesignation, amendments, and the risk of linking a citation to the wrong chapter
Driving Data Shows How an SDK Can Become a Data Supply Chain
Allstate, Arity, and General Motors allegations, recipient uses, and the current docket status
What the Texas Google Settlement Actually Resolved
Claims, agreed obligations, disposition, and limits of what a settlement establishes
Tracker
129 draft records of statutes, rules, enforcement actions, and court decisions, each with a legal status. Browse the Tracker, the Texas Attorney General docket view, or the 2027 legislative session view.