When did the TDPSA take effect?

The TDPSA took effect on July 1, 2024.

Does the TDPSA apply to small businesses?

Most of the law does not apply to a business that meets the U.S. Small Business Administration definition of a small business. One rule still applies to them: a small business may not sell sensitive personal data without the consumer's prior consent. Unlike many state privacy laws, Texas does not use a revenue or data-volume threshold.

Are RIAs and CPA firms exempt from the TDPSA?

Financial institutions subject to Title V of the Gramm-Leach-Bliley Act are exempt, and both RIAs and CPA firms are treated as financial institutions under that law, so many will fall under the exemption. Each firm should confirm this with counsel. The exemption does not remove obligations under SEC Regulation S-P, the FTC Safeguards Rule, or the Texas breach notification law.

What are the penalties under the TDPSA?

The Texas Attorney General enforces the law; there is no private right of action. The Attorney General must give notice and a 30-day period to cure before acting. Violations that are not cured carry civil penalties of up to $7,500 each, plus possible injunctions and recovery of attorney fees.

What Is the Texas Data Privacy and Security Act (TDPSA)?

Q: What is the Texas Data Privacy and Security Act?

The Texas Data Privacy and Security Act (TDPSA) is the Texas consumer privacy law, passed as House Bill 4. It gives Texas residents rights over their personal data and requires covered businesses to publish a privacy notice, limit data collection, use reasonable security, and get consent before processing sensitive data. The Texas Attorney General enforces it.

The Texas Data Privacy and Security Act (TDPSA) is the Texas consumer privacy law, passed as House Bill 4 and in effect since July 1, 2024. It gives Texas residents rights over their personal data and requires businesses that process that data to publish a privacy notice, limit what they collect, protect it with reasonable security, and get consent before processing sensitive data. The Texas Attorney General enforces it.

Who the TDPSA Applies To

Most state privacy laws apply only above a revenue or data-volume threshold. Texas does not use one. The TDPSA applies to a business that does three things:

conducts business in Texas or offers products or services consumed by Texas residents,
processes or sells personal data, and
is not a small business as defined by the U.S. Small Business Administration.

The small business carve-out has one important limit. Even a business that meets the SBA definition may not sell sensitive personal data without the consumer’s prior consent.

The law protects Texas residents acting in an individual or household context. Data about employees, job applicants, and business contacts acting in a commercial role falls outside it.

What Is Exempt

Several categories of organizations are exempt as a whole, including state agencies, nonprofits, institutions of higher education, financial institutions subject to Title V of the Gramm-Leach-Bliley Act, and covered entities and business associates under HIPAA. Certain types of data are also excluded wherever they sit, such as protected health information under HIPAA and data regulated by the Fair Credit Reporting Act.

The financial institution exemption matters for investment and accounting firms, because both are treated as financial institutions under Gramm-Leach-Bliley. Many RIAs and CPA firms will fall under that exemption, but it should be confirmed with counsel for each firm. An exemption from the TDPSA does not remove the firm’s obligations under SEC Regulation S-P, the FTC Safeguards Rule, or the Texas breach notification law.

What Covered Businesses Must Do

Publish a privacy notice that explains what personal data is collected, why, who it is shared with, and how consumers can use their rights.
Collect only what is needed. Data collection has to be adequate, relevant, and reasonably necessary for the purposes disclosed.
Protect the data with reasonable administrative, technical, and physical security practices.
Get consent for sensitive data, which includes health information, precise geolocation, biometric data, and data about children.
Run data protection assessments before targeted advertising, selling personal data, certain profiling, or processing sensitive data.
Put contracts in place with processors, the vendors that handle personal data on the business’s behalf.

Consumer Rights and the 45-Day Clock

Texas residents can ask a covered business to confirm whether it processes their data, give them access to it, correct it, delete it, and provide a portable copy. They can also opt out of targeted advertising, the sale of their data, and certain profiling. A business has 45 days to respond, with one 45-day extension when reasonably necessary, and must offer a way to appeal a refusal.

Meeting that clock depends on knowing where personal data lives. A firm without a data inventory cannot reliably find, export, or delete one person’s records across email, file shares, and line-of-business systems.

Enforcement and Penalties

The Texas Attorney General has exclusive authority to enforce the TDPSA. There is no private right of action, so consumers cannot sue under it directly. Before bringing an action, the Attorney General must give the business notice and 30 days to cure the violation, and unlike some other states, Texas did not set an end date for that cure period. Violations that are not cured carry civil penalties of up to $7,500 each, and the Attorney General can seek an injunction and recover attorney fees. The Attorney General’s office has made privacy enforcement a stated priority.

How the TDPSA Relates to Texas SB 2610

The two laws answer different questions. The TDPSA sets privacy obligations and is enforced by the Attorney General. Texas SB 2610 concerns data breach lawsuits: it protects businesses with fewer than 250 employees from exemplary damages if they maintain a cybersecurity program that conforms to a recognized framework. A separate law, covered in our entry on Texas data breach notification, sets the deadlines for notifying affected people and the Attorney General after a breach.

What connects them is documented security. The TDPSA requires reasonable security practices, SB 2610 rewards a framework-based program, and a fast, accurate breach notification depends on both.

Why the TDPSA Matters for Investment & Professional Firms

For DFW professional firms, the first question is whether the TDPSA applies at all, and the answer differs by firm type. RIAs and CPA firms often fall under the Gramm-Leach-Bliley exemption, while law firms and other professional practices above the SBA small business threshold may be covered. In every case, the security controls the law expects overlap with what clients and regulators already ask for. DKBinnovative has supported compliance-intensive firms since 2004, building the data inventory, access controls, and documented security program that support privacy requests and breach response, for firms in Frisco, Plano, Irving, and Las Colinas.

Related DKBinnovative Resources

This entry is general information, not legal advice. Confirm how the TDPSA applies to your firm with counsel.