Controller (Texas Data Privacy and Security Act)

Look at who decides. Under Tex. Bus. & Com. Code § 541.001, a controller is an individual or other person that, alone or jointly with others, determines the purpose and means of processing personal data. "Determines" is the whole test. A company that picks what data to collect, why it is collected, how long it is kept, and who else receives it is a controller, and no vendor agreement relabeling it as a service provider changes that.

Most Texas businesses subject to Chapter 541 are controllers. Many are also processors as to some other company's data. Both can be true at once for different data sets, and § 541.104(e) makes the classification a fact-based determination that depends on the context in which the data is processed.

The baseline duties

Section 541.101 sets the floor. Collection must be limited to what is adequate, relevant and reasonably necessary in relation to the purposes disclosed to the consumer. Security practices must be reasonable and appropriate to the volume and nature of the data. Processing for a purpose that is neither reasonably necessary to nor compatible with the disclosed purpose requires consent. Retaliating against a consumer who exercises rights is prohibited, subject to the loyalty program and opted-out-data allowances in § 541.101(c). Sensitive data may not be processed without consent under § 541.101(b)(4), and where the consumer is a known child the controller must comply with the federal Children's Online Privacy Protection Act instead.

Section 541.102 requires a reasonably accessible and clear privacy notice listing the categories of personal data processed, the purpose of processing, how a consumer exercises rights and appeals a refusal, the categories of data shared with third parties, the categories of those third parties, and the methods for submitting requests under § 541.055. Sell personal data to third parties or process it for targeted advertising, and § 541.103 requires a clear and conspicuous disclosure of that fact together with the manner of opting out.

Answering consumers

The controller answers requests, not the vendor. Section 541.052 sets a 45-day clock with one 45-day extension when reasonably necessary. Section 541.053 requires an appeal process, a written response within 60 days, and a method of contacting the attorney general if the appeal is denied. Section 541.105 requires documented data protection assessments for targeted advertising, sale of personal data, certain profiling, processing of sensitive data, and any processing presenting a heightened risk of harm to consumers.

Contracting down the chain

A controller may not hand personal data to a processor without the written contract described in § 541.104(b). That contract governs instructions, nature and purpose of processing, data types, duration, confidentiality, deletion or return, audit cooperation and subcontractor flow-down. Missing processor contracts are the most common finding in a first-pass TDPSA review, usually because a marketing team onboarded an analytics tool through a click-through order form and nobody read the section.

One scope point that saves argument later. Chapter 541 protects a consumer, defined in § 541.001 as a resident of this state acting only in an individual or household context, and § 541.003 pulls employment and applicant data out of the chapter entirely. A controller's obligations run to customers and site visitors rather than to its own workforce.