Affiliation Rules (Texas Privacy and SBA Size)

Affiliates come up twice in a Texas privacy analysis, and the two rules pull against each other. Inside Chapter 541, affiliate status is a shield: transfers to an affiliate are not sales, and affiliates are not third parties. Outside it, in the SBA size standards that determine whether Chapter 541 applies in the first place, affiliation is a trap, because affiliates get counted together.

Affiliates under Chapter 541

Section 541.001 defines an affiliate as a legal entity that controls, is controlled by, or is under common control with another legal entity, or that shares common branding with another legal entity. Control means ownership of, or the power to vote, more than 50 percent of the outstanding shares of any class of voting security, control in any manner over the election of a majority of the directors or individuals exercising similar functions, or the power to exercise a controlling influence over management.

Two consequences follow. The definition of sale of personal data excludes the disclosure or transfer of personal data to an affiliate of the controller, so intercompany data movement inside a corporate group does not by itself trigger the sale opt-out or the sensitive-data sale notice in § 541.102(b). And the definition of third party excludes an affiliate of the controller or processor, which narrows the third-party line items a privacy notice must carry under § 541.102(a).

Do not over-read either one. The exclusion covers the transfer. Once the affiliate holds the data it is a controller of that data and owes its own duties, including the sensitive data consent rule in § 541.101(b)(4) and its own notice under § 541.102. Common branding also deserves a flag: two entities with no ownership overlap at all can still be affiliates under Chapter 541 if they share branding, which matters for franchise systems and professional service alliances built on a shared name.

Affiliation under SBA rules

The definition that decides coverage is not in the Texas statute. Because § 541.002(a)(3) borrows the SBA's small business definition, the SBA's affiliation regulation at 13 C.F.R. § 121.103 comes with it. Concerns and entities are affiliates of each other when one controls or has the power to control the other, or a third party or parties controls or has the power to control both, and it does not matter whether control is actually exercised so long as the power exists. Under 13 C.F.R. § 121.103(a)(6) the SBA counts the receipts, employees or other measure of size of the concern whose size is at issue and all of its domestic and foreign affiliates, regardless of whether the affiliates are organized for profit.

Aggregation is what catches people. A newly formed Texas subsidiary with two employees and no revenue is not a small business if its parent is large. Portfolio companies under common fund control frequently aggregate. So do sibling entities in a family holding structure, and the SBA looks past formal ownership to options, convertible instruments, agreements to merge and identity of interest among close relatives. The Texas privacy definition of control and the SBA concept of control are not the same test, and a group can fail the SBA test while its members would not qualify as affiliates under § 541.001.

Run them in the right order

Do the group analysis first. Map every entity under common control, aggregate size using the correct industry code, and determine which entities in the group are covered by Chapter 541. Then, inside the group, apply the Chapter 541 affiliate definitions to decide which data flows count as sales and which are internal. Getting that order backwards produces a privacy program built on an exemption that never applied, which is a worse position than having no program at all, because the written analysis is now evidence.