What Is the Texas Data Privacy and Security Act?
The TDPSA applies to a person that conducts business in Texas or produces a product or service consumed by Texas residents, processes or engages in the sale of personal data, and is not a small business as defined by the U.S. Small Business Administration, subject to statutory exceptions. Consumers have rights to access, delete, correct, port, and opt out of targeted advertising, sale, or profiling. Businesses generally have 45 days, with a possible 45-day extension when permitted, to respond. The Texas AG has exclusive enforcement authority; penalties and the statutory notice/cure process must be checked in the current chapter.
At a glance
- Full name
- Texas Data Privacy and Security Act
- Short code
- TDPSA
- Effective date
- July 1, 2024
- Response reference
- 45 days in this snapshot
- Cure period
- 30 days in this snapshot
- Private right of action
- No
- Enforcement
- Texas Attorney General. Consumer Protection Division
- Penalty reference
- Up to $7,500 per violation
- Statutory citation
- Tex. Bus. & Com. Code Ch. 541
Who TDPSA applies to
A business is covered if it meets the applicability thresholds set out in Tex. Bus. & Com. Code Ch. 541. The thresholds listed below are the research record for this law. Whether one or more applies depends on the current statute, its exceptions, and the business's facts; do not assume a universal threshold structure.
- Conducts business in Texas or produces products/services targeted at Texas residents
- Processes or engages in the sale of personal data
- Is not a small business as defined by the SBA (exempt unless selling sensitive data without consent)
Consumer rights under TDPSA
Right to delete personal data (§ 541.051)
Right to opt out of targeted advertising and sale
Right to data portability
Right to appeal a denied request
Enforcement by AG; civil penalties up to $7,500 per violation
Notable features (vs. CCPA)
TDPSA uses the US Small Business Administration's definition to exempt small businesses, unlike the revenue and consumer-volume thresholds used in the CCPA provisions summarized here. The law also requires opt-in consent before processing sensitive personal data, subject to its definitions and exceptions.
Enforcement and penalty reference
Enforcing agency: Texas Attorney General. Consumer Protection Division
Penalty reference: Up to $7,500 per violation
Cure period: Before bringing an enforcement action, the Attorney General must give written notice identifying the alleged provisions and allow at least 30 days to cure. The statute also requires a written statement and other cure conditions before the no-action protection applies.
Private right of action: TDPSA is enforced exclusively by the Texas Attorney General. Consumers cannot sue businesses directly; the enforcement path is filing a complaint with the AG Consumer Protection Division.
Where to file a complaint: Texas Attorney General. Consumer Protection Division
How to exercise your TDPSA rights
- 1
Identify the business that holds your data. OfflistMe can help you review a provider route across 1,034 US/global workflow profiles in the 1,052-record research universe; it does not decide whether a law applies to a specific request.
- 2
Submit a request to the business's designated contact using the provider's current verification instructions. Include only the information reasonably needed to match your record and check the applicable Texas residency, scope, exemption, and verification rules before sending.
- 3
This research snapshot records a 45-day reference window for the modeled request. Confirm the current statute, request type, controller scope, extension rule, and verification date before treating it as a deadline.
- 4
If the provider does not respond or disputes the request, preserve the request and response record, review the applicable exceptions, and consider the Texas Attorney General. Consumer Protection Division complaint route at https://www.texasattorneygeneral.gov/consumer-protection/file-consumer-complaint. A complaint route does not itself guarantee deletion or a particular enforcement result.
Generate requests in under 60 seconds
Generate a TDPSA privacy request, $9 one-time
FAQ
Does the Texas TDPSA apply to out-of-state data brokers?+
Location alone does not decide coverage. An out-of-state provider may be covered if it conducts business in Texas or produces a product or service consumed by Texas residents, processes or sells personal data, and meets the chapter's non-small-business and exception rules. Check the current statute and provider facts before treating a request as legally covered.
What is the "cure period" under Texas law?+
The 30-day cure rule applies after the Texas Attorney General gives the business the statutory notice. It is not a universal 30-day deadline for the business to answer a consumer request, and filing an AG complaint does not itself guarantee a particular investigation or penalty timeline. Keep the request and response record, then use the current AG complaint instructions if the matter remains unresolved.
Can Texas residents sue data brokers directly?+
No. TDPSA has no private right of action. Enforcement is exclusive to the Attorney General. Filing a complaint with the AG's Consumer Protection Division is the enforcement path.
What Texas-specific brokers should I target?+
Texas court and property records are separate source systems from a people-search provider's copy. If you find a matching listing, save the exact source privately, use the provider's current request route, and separately check whether the underlying public record has its own correction or confidentiality process. Do not assume a named provider or county source has a particular data relationship without current evidence.
Official sources & citations
Compare with sibling state laws
TDPSA is one of 18 comprehensive US state privacy laws. Its closest peers by effective date, useful when tracking how this law influenced or was influenced by neighboring legislation: