Texas Data Breach Notification Law

How the Texas data breach notification law works

Under the Texas data breach notification law, any unauthorized acquisition of data that compromises sensitive personal information triggers notice, and there is no exception for a breach the business judges harmless ¹. A vendor that only maintains data for someone else must tell the owner immediately after discovery ¹.

Sensitive personal information starts with the usual set: a name with a Social Security number, a driver's license or other government-issued ID number, or a financial account or card number with its access code. Texas adds a rule that matters for clinics, therapists and benefits administrators: health information that identifies a person counts on its own ¹.

The law also reaches past the state line. The duty to notify individuals covers affected people wherever they live, though residents of a state with its own notice law may be handled under that state's law instead ¹. Section 521.052 separately requires reasonable security procedures ¹.

Two Texas deadlines: 60 days for people, 30 for the Attorney General

Texas runs two clocks, and both start on the date the business determines that the breach occurred ¹.

• Affected individuals: without unreasonable delay and no later than day 60.
• Texas Attorney General: as soon as practicable and no later than day 30, if the breach involves at least 250 Texas residents. The report goes in through the AG's online Data Breach Report form ¹².
• Credit bureaus: if you notify more than 10,000 people about one breach, the nationwide consumer reporting agencies must be told too ¹.

The AG deadline is half the individual one, so the state may hear from you before your customers do. S.B. 768 cut it from 60 days to 30 in 2023, the last change to the notice rules ³.

Watch the start date. The AG's reporting page says the 30 days run from discovery of the breach, while the statute counts from the date you determine it occurred ¹². Until that gap is resolved, count from the earlier date. The AG also posts a public list of reported breaches ².

No harm exception in Texas, so encryption carries the weight

Many states let a business skip notice after an investigation shows misuse is unlikely. Texas does not. If sensitive personal information was acquired without authorization, notice is owed ¹.

Encryption is the main way out. Encrypted data is exempt unless the person who accessed it has the key needed to decrypt it ¹. Three questions for your IT provider:

• Are laptops and phones fully encrypted, and can you prove it for a lost device?
• Are backups encrypted, with keys and admin passwords stored where an attacker would not find them?
• If an attacker signed in as a user, did they see the data the way the user does? Then encryption may not help.

Get the answers in writing now.

Texas breach penalties and lawsuits

Only the Attorney General enforces the notice law. The AG may seek a civil penalty of $2,000 to $50,000 for each violation, plus up to $100 per individual for each day of failure to notify, capped at $250,000 for a single breach ¹.

Chapter 521 does not expressly give customers a right to sue, but breach lawsuits under other law still happen. S.B. 2610, effective September 1, 2025, says a Texas business with fewer than 250 employees that kept a qualifying cybersecurity program at the time of the breach cannot be made to pay exemplary damages in a breach lawsuit ⁴. A program that conforms to a framework such as the NIST Cybersecurity Framework is one example ⁴.

The program has to exist before the breach. A written information security plan built on a recognized framework and kept current is the record that protection depends on.

The first days after a Texas breach

With an attack in progress, a Texas company holding a cyber policy rings the carrier before anyone else, reports the crime to the FBI's IC3 online, and keeps the affected systems and logs intact instead of wiping them ⁶⁹⁷. Texans sent IC3 97,912 complaints in 2025 and reported about $1.83 billion lost, second among the states on both counts ⁸.

Then:

1. Lock down systems. If the people who run your IT cannot contain it, bring in a dedicated response firm.
2. Read the policy before hiring a lawyer; many carriers insist on their panel firms, as what insurers require of small businesses explains.
3. Record the date you determined a breach occurred. Both Texas deadlines run from it.
4. Count affected people by state, since residents elsewhere bring their own laws; the notice rules for every state are in one table.
5. Calendar day 30 and day 60, and draft notices with counsel.

Texas law is the same in Houston, Dallas, Austin, San Antonio, Fort Worth, Plano, Irving, El Paso and Lubbock, where our city pages cover local IT support costs.

Other rules that stack on the Texas law

• Texas Data Privacy and Security Act. In effect since July 1, 2024, with no consumer count threshold. Businesses that are small under the U.S. Small Business Administration definition are excluded, except that they still need consent before selling sensitive data ⁵.
• HIPAA. Health care providers, plans and business associates have a separate federal duty, covered in our HIPAA breach notification rule guide.
• FTC Safeguards Rule. Tax preparers, mortgage brokers, auto dealers and other non-bank financial firms have their own reporting duty.
• Neighboring states. Customers across the border bring in Oklahoma's breach law or Louisiana's.

Business and Commerce Code section 521.053 was compared with this summary on October 13, 2026. Use the page as a plain-language map, not legal advice, and confirm your obligations with Texas counsel.