TX BC 521

No changes recorded yet — we are watching, and nothing has been published.

1. 2023-09-01 Attorney General notice due within 30 days for breaches of 250 or more Texans (SB 768)
2. 2021-09-01 Attorney General public listing of breach notifications required (HB 3746)
3. 2020-01-01 60-day deadline for notifying individuals takes effect (HB 4390)
4. 2009-04-01 Chapter 521 takes effect

1. 2023-09-01
   Business & Commerce Code ch. 521, as amended by SB 768 (2023) AmendmentCurrent text

   SB 768 (Acts 2023, ch. 246) shortened the deadline for notifying the Attorney General from the 60th to the 30th day after the breach is determined and required the electronic form. source

2. 2021-09-01
   HB 3746 (2021) Amendment

   HB 3746 (Acts 2021, ch. 496) amended the Attorney General notification requirements and required the Attorney General to post a public listing of the notifications received. source

3. 2021-09-01
   HB 3529 (2021) Amendment

   HB 3529 (Acts 2021, ch. 143), effective 1 September 2021, amended section 521.051 on unauthorized use or possession of personal identifying information. source

4. 2020-01-01
   HB 4390 (2019) Amendment

   HB 4390 (Acts 2019, ch. 1326) replaced "as quickly as possible" with a 60-day deadline for notifying individuals and required notice to the Attorney General for breaches of at least 250 Texans. source

5. 2013-06-14
   SB 1610 (2013) Amendment

   SB 1610 (Acts 2013, ch. 1368), effective 14 June 2013, amended the breach notification section 521.053. source

Every business holding sensitive personal information, and anyone doing business in Texas who owns computerized sensitive personal information, including about residents of other states.

Security and disposal

A business must keep reasonable procedures to protect sensitive personal information and destroy customer records it will not retain; financial institutions under 15 U.S.C. 6809 are excluded (521.052). source

Breach notice

A person who conducts business in Texas and owns or licenses computerized sensitive personal information must notify affected individuals of a breach of system security (521.053(b)). source

Other states

For residents of a state that has its own breach-notice law, notice may be given under that state's law or under the Texas section (521.053(b-1)). source

Sensitive information

A name with an unencrypted SSN, driver's licence or government ID number, or financial account number with its access code; or information identifying a person and relating to health or health care payment (521.002). source

The business notifies individuals within 60 days and the Attorney General within 30 days for breaches of 250 or more Texans, and credit agencies above 10,000 people.

Individuals

Without unreasonable delay and not later than the 60th day after determining that the breach occurred, subject to law enforcement delay (521.053(b), (d)). source

Attorney General

For breaches involving at least 250 Texas residents, as soon as practicable and not later than the 30th day, through the Attorney General's online form (521.053(i)). source

Credit agencies

If more than 10,000 persons are notified at one time, also notify nationwide consumer reporting agencies without unreasonable delay (521.053(h)). source

Public listing

The Attorney General posts a listing of the notifications received and removes each a year after it is added if no further breaches are reported (521.053(j)). source

The Attorney General recovers civil penalties of $2,000 to $50,000 per violation, plus up to $100 per person per day for late breach notice, capped at $250,000 per breach.

Injunctions

The Attorney General may seek a temporary restraining order or injunction and recover reasonable expenses, including attorney's fees and investigation costs (521.151). source

1. Law text Business & Commerce Code chapter 521 – Unauthorized Use of Identifying Information
2. Law text SB 768 (88th Legislature), enrolled text
3. Law text HB 3746 (87th Legislature), enrolled text
4. Law text HB 4390 (86th Legislature), enrolled text

1. TX DPSA

   The Texas Data Privacy and Security Act sets consumer privacy rights and controller duties; chapter 521 covers security of sensitive personal information and breach notification.

2. TX SB 2610

   SB 2610 (Business & Commerce Code chapter 542) is a separate Texas cybersecurity safe-harbour statute; chapter 521 sets the underlying security and breach-notice duties.

3. CA SB 1386

   California requires notice to residents within 30 days and a sample notice to the Attorney General above 500 residents; Texas allows up to 60 days.

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 20 September 2026. Subscribe to TX BC 521 (RSS)