Sign in

TX DPSA

Texas Data Privacy and Security Act (HB 4, Business & Commerce Code Ch. 541) — Texas Legislature

Also known as: TDPSA, Texas Data Privacy and Security Act, Texas HB 4, Business and Commerce Code Chapter 541

Official site Official change log Subscribe to TX DPSA (RSS)

Current version
Business & Commerce Code ch. 541, as amended by HB 149 (2025)
Published 1 January 2026. source
Status
In force
Next deadline
None announced
Who must comply
Persons that conduct business in Texas or produce products or services consumed by Texans, process or sell personal data, and are not small businesses as defined by the US SBA. source
How it is assessed
Controllers handle rights requests within 45 days, publish a privacy notice, get consent for sensitive data and document data protection assessments. source
Authority
The Texas Data Privacy and Security Act (HB 4 of 2023); the Attorney General has exclusive authority to enforce it. source
Enforced by
The Attorney General alone enforces the Act after a 30-day cure notice, with civil penalties of up to $7,500 per violation and no private right of action. source
Last change
None recorded yet

Texas's comprehensive privacy statute, and the one with the widest reach: it binds any entity that does business in Texas and processes personal data, except small businesses as the federal definition draws them (which still may not sell sensitive data without consent) and exempt bodies such as state agencies, financial institutions, HIPAA entities, nonprofits and higher education, rather than applying above a threshold of records or revenue. Residents get access, correction, deletion, portability and an opt-out of sale, targeted advertising and profiling; the Attorney General enforces after a cure period.

Recent changes

No changes recorded yet — we are watching, and nothing has been published.

Key dates

No upcoming dates
  1. HB 149 amendment to the processor duties (section 541.104) takes effect
  2. Section 541.055(e) takes effect – opt-out through an authorized agent, including browser settings or global device settings
  3. Texas Data Privacy and Security Act takes effect

Amendments

  1. Business & Commerce Code ch. 541, as amended by HB 149 (2025) AmendmentCurrent text

    HB 149 (Acts 2025, ch. 1174), the Texas act regulating the use of artificial intelligence, extended the processor's duty to assist with security in section 541.104 to personal data collected, stored and processed by an AI system. source

  2. HB 4 (2023) – Texas Data Privacy and Security Act Major version

    Chapter 541 was added by Acts 2023, 88th Legislature, chapter 995 (HB 4), effective 1 July 2024; the authorized-agent opt-out in section 541.055(e) took effect on 1 January 2025. source

Who it applies to

Any business that processes or sells Texans' personal data and is not an SBA small business, plus small businesses selling sensitive data; government, GLBA and HIPAA entities, nonprofits and universities are exempt.

Who
A person that conducts business in Texas or produces a product or service consumed by Texans, processes or sells personal data, and is not a small business as defined by the SBA (541.002(a)). source
Small businesses
A small business may not sell sensitive personal data without the consumer's prior consent, under the same penalty (541.107). source
Exempt entities
State agencies and political subdivisions, GLBA financial institutions, HIPAA covered entities and business associates, nonprofits, higher education and certain electric utilities (541.002(b)). source
Sensitive data
Includes racial or ethnic origin, religion, health, sexuality, citizenship or immigration status, genetic or biometric data used to identify, data of a child under 13 and precise geolocation. source

How compliance is assessed

Controllers handle rights requests within 45 days, publish a privacy notice, get consent for sensitive data and document data protection assessments.

Consumer rights
Confirm and access, correct, delete, obtain a portable copy, and opt out of targeted advertising, sale and significant profiling (541.051). source
Response time
Respond without undue delay and within 45 days, extendable once by 45 days with notice and reasons; free of charge at least twice a year per consumer (541.052). source
Privacy notice
A clear privacy notice of data categories, purposes, sharing and how to exercise rights, plus set notices when selling sensitive or biometric data (541.102). source
Assessments
Document data protection assessments for targeted advertising, sale, risky profiling, sensitive data and other heightened-risk processing (541.105). source
Security
Maintain reasonable administrative, technical and physical data security practices suited to the volume and nature of the data (541.101(a)). source

Enforcement and penalties

The Attorney General alone enforces the Act after a 30-day cure notice, with civil penalties of up to $7,500 per violation and no private right of action.

Up to $7,500 per violation

For violations after the cure period or breach of a written cure statement; the Attorney General may also seek an injunction and recover fees and expenses (541.155). source

Cure period
The Attorney General must give 30 days' written notice; no action if the person cures and gives a written statement with supporting documentation (541.154). source
Private suits
The chapter may not be construed as providing a basis for a private right of action (541.156). source
Investigations
The Attorney General may issue civil investigative demands, including for data protection assessments (541.153). source

Documents

  1. Law text Business & Commerce Code chapter 541 – Consumer Data Protection
  2. Law text HB 4 (88th Legislature), enrolled text
  3. Law text HB 149 (89th Legislature), enrolled text
  4. Guidance Texas Attorney General – Texas Data Privacy and Security Act

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 20 September 2026. Subscribe to TX DPSA (RSS)