Meet your TDPSA privacy duties with less manual work

The Texas Data Privacy and Security Act (TDPSA) is a comprehensive consumer privacy law enacted by House Bill 4 in 2023 and codified as Chapter 541 of the Texas Business and Commerce Code. It took effect on 1 July 2024. It gives Texas residents rights over their personal data and requires businesses to limit collection, secure data, publish a privacy notice, obtain consent for sensitive data and assess higher-risk processing.

The TDPSA applies to any person that conducts business in Texas or produces products or services consumed by Texas residents, processes or sells personal data, and is not a small business as defined by the US Small Business Administration. There is no revenue or consumer volume threshold. State agencies, nonprofits, higher education institutions, GLBA financial institutions and HIPAA covered entities and business associates are exempt.

Texas consumers can confirm whether a controller processes their personal data and access it, correct inaccuracies, delete their data, obtain a portable copy, and opt out of targeted advertising, the sale of personal data and profiling that produces legal or similarly significant effects. Controllers must respond within 45 days, offer an appeal process, and provide information free of charge at least twice a year.

The Texas Attorney General can seek a civil penalty of up to $7,500 for each violation, along with injunctive relief and reasonable attorney's fees and investigation costs. Before suing, the Attorney General must give 30 days' written notice, and no action can be brought if the business cures the violation and provides a written statement. Unlike some states, this cure period does not expire. There is no private right of action.

Yes. Section 541.105 requires controllers to conduct and document a data protection assessment for targeted advertising, the sale of personal data, certain profiling, processing sensitive data and any other processing that presents a heightened risk of harm to consumers. Assessments must weigh benefits against risks and be disclosed to the Attorney General on request. An assessment done for another law can count if it is reasonably comparable in scope and effect.

The TDPSA shares GDPR concepts such as controllers and processors, data minimisation, consent for sensitive data, processor contracts and data protection assessments. It differs because it protects only Texas residents acting in a personal or household context, relies on opt-out rights for advertising and sale instead of a lawful basis for all processing, and is enforced only by the Attorney General. A GDPR programme helps but does not cover Texas-specific notices.

Start by confirming whether the law applies and mapping the personal data you hold about Texas residents. Then publish a privacy notice with the required disclosures, provide at least two secure ways to submit requests, respond within 45 days with an appeal route, get consent before processing sensitive data, sign compliant processor contracts, maintain reasonable data security and document data protection assessments for higher-risk processing.

The Texas Data Privacy and Security Act is mapped in OneClickComply's control library and is available on request. Its controls link to the same evidence, policies, vendor reviews and risk register entries used for frameworks such as ISO 27001 and SOC 2, so work done once counts towards the TDPSA too. OneClickComply does not certify TDPSA compliance, but its in-house audit team can advise on your approach.