Texas Data Privacy and Security Act (TDPSA)

Texas got a comprehensive privacy law on July 1, 2024, and the thing most businesses get wrong about it is who has to comply. Chapter 541 of the Business and Commerce Code has no revenue floor. It sets no minimum number of Texas residents whose data you handle. Fifty customers or five million, the statute reads the same.

The test sits in Tex. Bus. & Com. Code § 541.002(a). A person is covered if it conducts business in this state or produces a product or service consumed by residents of this state, processes or engages in the sale of personal data, and is not a small business as defined by the United States Small Business Administration. Three elements. The third one does all the work.

Why the SBA cross-reference changes the analysis

Every other comprehensive state privacy statute draws its line with numbers written into the statute itself. Virginia and Colorado count consumers. California counts revenue, consumer volume, and revenue derived from selling data. Texas outsources the line to a federal agency. The SBA sets size standards by industry, published by North American Industry Classification System code at 13 C.F.R. § 121.201, some expressed in average annual receipts and some in employee headcount.

So the first compliance question for a Texas business is not how much revenue it earns. It is which NAICS code describes its primary activity, what standard the SBA assigns that code, and whether affiliates have to be counted in. A staffing agency and a software publisher with identical financials can land on opposite sides of the line.

What coverage requires

Covered controllers owe data minimization and reasonable security under Tex. Bus. & Com. Code § 541.101, a conforming privacy notice under § 541.102, a written contract with every processor under § 541.104, and documented data protection assessments for higher-risk processing under § 541.105. Consumers get the rights listed in § 541.051 and a 45-day response clock in § 541.052. Sensitive data cannot be processed at all without consent.

Several categories sit outside the chapter regardless of size. Section 541.002(b) exempts state agencies and political subdivisions, financial institutions and data subject to Title V of the Gramm-Leach-Bliley Act, HIPAA covered entities and business associates, nonprofit organizations, institutions of higher education, and electric utilities, power generation companies and retail electric providers as defined by Section 31.002 of the Utilities Code. Data-level carve-outs follow in § 541.003, including employment and applicant information.

Enforcement

The attorney general has exclusive authority under § 541.151, and § 541.156 forecloses any private right of action. Before suing, the attorney general must give 30 days' written notice identifying the provisions allegedly violated, and may not proceed if the business cures within that window and delivers the written statement described in § 541.154. Penalties run to $7,500 for each violation under § 541.155, plus reasonable attorney's fees and expenses of investigating and bringing the action.

The office has used it. In January 2025 the attorney general sued Allstate and its analytics affiliate Arity over driving and location data collected through mobile applications, pleading failures of notice, of consent for precise geolocation, and of opt-out mechanics. The first claims out of the gate were sensitive data claims. Anyone building a Texas privacy program should read that as a signal about where the office looks first. The case is State of Texas v. Allstate Corp., Cause No. 25-01-00561, in the 457th Judicial District Court of Montgomery County. It has not been a straight line: in April 2025 the court granted special appearances and dismissed The Allstate Corporation and Arity 875, LLC for want of personal jurisdiction, and the action continues against the remaining entities.