| name | texas-tdpsa-compliance |
| title | Texas Data Privacy and Security Act (TDPSA) |
| description | Texas Data Privacy and Security Act (TDPSA) compliance. No revenue threshold applies to all businesses. Covers data broker registration requirements, biometric identifier provisions under CUBI, consumer rights, AG enforcement, and 30-day cure period. Effective July 1, 2024. |
| author | mukul975 |
| author_url | https://github.com/mukul975/Privacy-Data-Protection-Skills/tree/main/skills/privacy/texas-tdpsa-compliance |
| license | Apache-2.0 |
| version | 0.1.0 |
| execution_mode | open |
| jurisdiction | us |
| practice | data-protection |
| language | en |
Texas Data Privacy and Security Act (TDPSA)
Overview
The Texas Data Privacy and Security Act (TDPSA), codified as Tex. Bus. & Com. Code §541.001 through §541.203, was signed into law on June 18, 2023 (HB 4), and became effective July 1, 2024. Texas is the largest state by population to enact comprehensive consumer privacy legislation and is notable for having no revenue threshold for applicability — the TDPSA applies to any person that conducts business in Texas or produces products or services consumed by Texas residents, regardless of company size.
The TDPSA also interacts with the existing Texas Capture or Use of Biometric Identifier Act (CUBI), Tex. Bus. & Com. Code §503.001, which provides separate biometric data protections.
Applicability (§541.002)
The TDPSA applies to a person that:
- Conducts business in Texas or produces a product or service consumed by Texas residents
- Processes or engages in the sale of personal data
- Is not a small business as defined by the U.S. Small Business Administration (SBA)
Key feature: No revenue or consumer count threshold. Unlike California ($25M revenue), Virginia (100,000 consumers), or Colorado (100,000 consumers), the TDPSA applies broadly to any non-small business processing personal data of Texas residents.
Small business exemption: Small businesses as defined by SBA size standards are exempt from most provisions but are NOT exempt from the prohibition on selling sensitive data without consent (§541.107(b)).
Additional exemptions (§541.003):
- State agencies and political subdivisions
- Financial institutions subject to GLBA (entity-level)
- Covered entities and business associates under HIPAA (entity-level)
- Nonprofit organizations
- Institutions of higher education
- Electric utilities (ERCOT-related)
Liberty Commerce Inc. Assessment:
Liberty Commerce Inc. is not an SBA-defined small business (annual revenue: $48M, 320 employees). It conducts business in Texas and processes personal data of Texas residents. The TDPSA applies.
Consumer Rights (§541.051)
Five Consumer Rights
- Right to Access (§541.051(1)): Confirm processing and access personal data
- Right to Correct (§541.051(2)): Correct inaccuracies
- Right to Delete (§541.051(3)): Delete personal data
- Right to Portability (§541.051(4)): Obtain data in portable, readily usable format
- Right to Opt Out (§541.051(5)): Opt out of:
