Texas Data Privacy and Security Act (TDPSA) Assessment

The TDPSA applies only where there is a Texas business or product/service nexus. A “consumer” is a Texas resident acting only in an individual or household context, not in a commercial or employment context.

The TDPSA generally applies where an in-scope organization processes personal data or engages in the sale of personal data. Texas defines “sale of personal data” broadly as sharing, disclosing, or transferring personal data for monetary or other valuable consideration, subject to listed exclusions.

The TDPSA generally does not apply to a small business as defined by the United States Small Business Administration, except that a small business may not engage in the sale of sensitive personal data without first obtaining consumer consent. This is one of the most important Texas-specific scoping rules.

The TDPSA includes exemptions for certain entities and data categories, including state agencies and political subdivisions, Gramm-Leach-Bliley Act (GLBA)-regulated financial institutions and data, Health Insurance Portability and Accountability Act (HIPAA) covered entities and business associates, nonprofits, institutions of higher education, and certain categories of health, employment, research, Fair Credit Report Act (FCRA), Family Educational Rights and Privacy Act (FERPA), Driver's Privacy Protection Act (DPPA), and emergency-contact data.

A data mapping activity can help your organization discover different types of data it has stored or processed within its various data stores. For data mapping, you should document what types of data you are collecting; when and how that data is being collected and used; where the data is being stored; how data flows through various systems and vendors; who has access to both the collected data and other information technology systems; and what procedural safeguards are in place to protect the systems and data.

The TDPSA gives consumers rights to access, correction, deletion, portability, and opt out. Controllers generally must respond within 45 days, with one possible 45-day extension when reasonably necessary. Texas also requires at least two secure and reliable methods for submitting requests, adjusted to how consumers normally interact with the business.

The TDPSA gives consumers the right to opt out of targeted advertising, the sale of personal data, and profiling in furtherance of decisions producing legal or similarly significant effects. It also recognizes certain opt-out requests through authorized agents and technology-based mechanisms in some circumstances.

The TDPSA requires valid consent before processing sensitive personal data, known children’s data in line with COPPA where applicable, and personal data for purposes that are not reasonably necessary to or compatible with originally disclosed purposes. Texas defines consent as a clear affirmative act and excludes passive behavior and dark patterns.

The TDPSA requires a reasonably accessible and clear privacy notice describing categories of personal data processed, purposes, rights and appeals, categories of shared data and third parties, and methods for submitting consumer requests. Texas also requires special notices if a business sells sensitive personal data or biometric personal data.

The TDPSA requires reasonable security practices appropriate to the volume and nature of the personal data and requires processor contracts covering instructions, confidentiality, deletion or return, information-sharing to demonstrate compliance, subcontractor obligations, and assessments or reports.

The TDPSA requires data protection assessments for targeted advertising, the sale of personal data, certain profiling, sensitive-data processing, and other processing activities that present a heightened risk of harm to consumers. Texas allows comparable assessments under other laws to count if they are reasonably similar in scope and effect.

The TDPSA excludes certain de-identified data from obligations if reasonable measures are taken to prevent re-identification, there is a public commitment not to re-identify, and recipients are contractually bound. It also gives special treatment to certain pseudonymous data in some consumer-rights contexts.

It points to Chapter 521, Title 11 of the Texas Business and Commerce Code for Texas breach-notification obligations. That breach law is separate from the TDPSA but operationally related to privacy readiness. Texas requires notice to affected individuals as quickly as possible and, in some cases, notice to the Attorney General when a breach affects a large number of residents.

Even where small businesses are generally outside the TDPSA’s main scope, Texas separately prohibits a small business from selling sensitive personal data without prior consumer consent. This is one of the most important Texas-specific carve-in rules.

Documentation matters for defensibility and investigation response. The TDPSA gives exclusive enforcement authority to the Texas Attorney General and includes a complaint mechanism and investigative authority.