← Global Privacy Laws Research Library
Tex. Bus. & Com. Code Chapter 541
Texas Data Privacy and Security Act
Prepared by Shubhank Suman · Last reviewed
CURRENT / IN FORCE
- Legal character
- Statute
- Region
- North America
What it covers
The Act applies to persons doing business in Texas or producing products or services consumed by Texans that process or sell personal data and are not small businesses (small businesses still need consent before selling sensitive data). Consumers may confirm, access, correct, delete and port data and opt out of targeted advertising, sale and profiling. Controllers need consent for sensitive data, must give privacy notices, disclose sale of sensitive or biometric data, and conduct data protection assessments. Processors work under contract. The Attorney General enforces exclusively after a 30-day cure period, with civil penalties up to $7,500 per violation.
Why it matters
It is the privacy law of one of the largest US State economies and applies without a revenue or volume threshold.
Refer to it when
Use it when processing personal data of Texas consumers.
AI, privacy and cybersecurity relevance
- AI: Moderate
- Privacy: Very High
- Cyber: Moderate
AI
MODERATE RELEVANCE
Opt-out of profiling.
Privacy
VERY HIGH RELEVANCE
Comprehensive State consumer privacy law.
Cybersecurity
MODERATE RELEVANCE
Data security practices.
Applicability
Businesses processing personal data of Texas consumers, other than small businesses (except for sensitive data sales).
Current validity
CURRENT. In force from 1 July 2024. Read the official PDF on this page for the operative text.
Read first
Section 541.001 → 541.002 → Subchapter B → Subchapter C → Subchapter E.
Provisions / sections covered
Subchapter A – General provisions
Definitions, applicability and exemptions.
Subchapter B – Consumer rights
Rights, requests and appeals.
Subchapter C – Controller and processor duties
Notice, sensitive data consent and processor contracts.
Subchapter D – Data protection assessments
Assessments for targeted advertising, sale, profiling and sensitive data.
Subchapter E – Enforcement
Attorney General enforcement, cure period and penalties.
Subject-matter tags
- Consent
- Sensitive data
- Profiling
- Controller and processor
- Biometrics
- Enforcement and penalties
Subject-matter tags describe what the indexed text discusses. They are not legal conclusions.
Document page in the Knowledge Base - full text or PDF where it is available for this record.
This library locates primary and official sources. It does not interpret the law and it is not legal advice.