Meet Texas Chapter 521 security and breach notice duties with ease

Chapter 521 is the Texas Identity Theft Enforcement and Protection Act. It prohibits unauthorised use of personal identifying information, requires businesses to implement reasonable procedures to protect sensitive personal information and to destroy records securely, and sets the state's data breach notification rules in Section 521.053. The Texas Attorney General enforces it through civil penalties and injunctions.

Under Section 521.002, sensitive personal information is a person's first name or initial and last name combined with an unencrypted Social Security number, driver's licence or government ID number, or a financial account or card number with its access code. It also covers information that identifies someone and relates to their physical or mental health, healthcare or payment for healthcare. Lawfully public government information is excluded.

Affected individuals must be notified without unreasonable delay and no later than 60 days after the business determines the breach occurred, unless law enforcement asks for a delay. If the breach involves at least 250 Texas residents, the Attorney General must also be notified as soon as practicable and within 30 days, using the electronic form on the Attorney General's website.

Under Section 521.151, a person who violates the chapter is liable for a civil penalty of $2,000 to $50,000 per violation. A business that fails to take reasonable action to notify individuals of a breach can face an additional penalty of up to $100 per individual per day, capped at $250,000 for a single breach. The Attorney General can also seek injunctions and recover its costs.

The security and disposal duty in Section 521.052 applies to any business that collects or maintains sensitive personal information, including nonprofit athletic or sports associations, but not federally defined financial institutions. The breach notification duty applies to any person who conducts business in Texas and owns or licenses computerised sensitive personal information. Service providers that hold data for others must notify the data owner immediately after discovering a breach.

They are separate laws that often apply together. Chapter 521 focuses on securing sensitive personal information and notifying people after a breach, while the Texas Data Privacy and Security Act (TDPSA) gives consumers privacy rights and sets broader obligations for controllers and processors. A business covered by the TDPSA still needs to follow Chapter 521's breach notification deadlines when a breach occurs.

Yes, partly. Chapter 521 requires reasonable procedures to protect sensitive personal information but does not prescribe specific controls, so a recognised programme such as ISO 27001 or SOC 2 is useful evidence of reasonable security and secure disposal. Neither replaces the statute's breach notification rules, so you still need a response plan covering the 60-day individual and 30-day Attorney General deadlines.

Texas Business and Commerce Code Chapter 521 is mapped in OneClickComply's control library and is available on request. Once enabled, OneClickComply links its security, disposal and breach reporting duties to your existing controls, collects evidence automatically from connected tools and monitors for drift. OneClickComply does not guarantee compliance, but it gives you organised evidence and expert support from its in-house audit team.