Earn the Texas SB 2610 safe harbour with a provable security programme

Texas SB 2610 is a 2025 Texas law creating a cybersecurity safe harbour for small businesses. It adds Chapter 542 to the Business and Commerce Code and bars exemplary damages in data breach lawsuits against businesses with fewer than 250 employees, provided they implemented and maintained a qualifying cybersecurity programme at the time of the breach. It took effect on 1 September 2025.

A business entity in Texas qualifies if it has fewer than 250 employees and owns or licenses computerised data that includes sensitive personal information. It must also show that, when the breach happened, it had implemented and maintained a cybersecurity programme meeting Section 542.004. Larger businesses, and those without such a programme, cannot rely on it.

No. Texas SB 2610 does not require any business to adopt a cybersecurity programme and creates no private cause of action. It is an incentive: businesses that voluntarily build and maintain a qualifying programme gain protection from exemplary damages. Separate Texas data breach notification and security duties under Chapter 521 of the Business and Commerce Code still apply.

It protects only against exemplary damages, the punitive damages a court can award on top of actual losses. A person harmed by the breach can still sue and recover compensatory damages, and regulators can still take enforcement action. The law also states it does not change any common law or statutory duty, so it reduces exposure rather than removing liability.

The programme must contain administrative, technical and physical safeguards for personal and sensitive personal information and conform to a recognised framework. Requirements scale by size: under 20 employees need simplified measures such as password policies and staff training; 20 to 99 need moderate measures including CIS Controls Implementation Group 1; and 100 to 249 must conform fully to a listed framework.

Section 542.004(b) lists current versions of the NIST Cybersecurity Framework, NIST SP 800-171, NIST SP 800-53 and 800-53A, the FedRAMP Security Assessment Framework, the CIS Critical Security Controls, the ISO/IEC 27000 series, HITRUST CSF, SOC 2 and similar industry frameworks. Businesses must also meet HIPAA, GLBA, FISMA, HITECH or PCI DSS where those apply to them.

ISO 27001 and SOC 2 are both named as qualifying frameworks, so a business already conforming to either is well placed to claim the safe harbour. Texas SB 2610 does not itself require certification or an audit report, but independent assurance makes it far easier to demonstrate that the programme was implemented and maintained at the time of a breach.

Yes. Texas SB 2610 is supported in OneClickComply today. Because it relies on recognised frameworks such as NIST CSF, ISO 27001, SOC 2 and the CIS Controls, OneClickComply helps you build and evidence the underlying programme. OneClickComply does not guarantee the safe harbour applies; that is decided by a court.