TX SB 2610

No changes recorded yet — we are watching, and nothing has been published.

1. 2025-09-01 Chapter 542 takes effect; the safe harbor applies to causes of action accruing on or after this date
2. 2025-06-20 S.B. 2610 signed by the Governor

1. 2025-09-01
   Business & Commerce Code chapter 542 (S.B. 2610, 2025) Major versionCurrent text

   Chapter 542, "Cybersecurity Program", added by S.B. 2610 of the 89th Legislature; its safe harbor (section 542.003) applies only to causes of action that accrue on or after the Act takes effect, 1 September 2025. source

Small and mid-sized Texas businesses that hold sensitive personal information and keep a cybersecurity program scaled to their headcount.

Who it covers

Only business entities in Texas with fewer than 250 employees that own or license computerized data including sensitive personal information (section 542.002). source

Fewer than 20 employees

Simplified requirements, including password policies and appropriate employee cybersecurity training. source

20 to 99 employees

Moderate requirements, including the requirements of CIS Controls Implementation Group 1. source

100 to 249 employees

Conformity to a recognised framework such as the NIST Cybersecurity Framework, NIST SP 800-171, NIST SP 800-53, FedRAMP, CIS Controls, ISO/IEC 27000 series, HITRUST CSF, the Secure Controls Framework or SOC 2. source

Sector rules

Where they apply, the program also conforms to HIPAA, Title V of Gramm-Leach-Bliley, FISMA, HITECH and the current PCI DSS. source

The business demonstrates in litigation that it kept a conforming program at the time of the breach, and updates it when a referenced standard changes.

Burden

The entity must demonstrate that at the time of the breach it implemented and maintained a cybersecurity program complying with section 542.004. source

Program content

Administrative, technical and physical safeguards for personal identifying and sensitive personal information, designed against threats to its security and integrity and against unauthorised access that would create a material risk of identity theft or fraud. source

Updated standards

When a referenced framework is updated, the program must be updated by the later of the standard's own implementation date or the first anniversary of its publication. source

A shield, not a duty: a qualifying business cannot be ordered to pay exemplary damages over a breach, and the chapter creates no private cause of action.

Safe harbor

A person harmed by a breach of system security may not recover exemplary damages from a covered entity that demonstrates a compliant program (section 542.003). source

No private action

The chapter may not be construed to create a private cause of action or change a common law or statutory duty (section 542.005). source

1. Law text Business & Commerce Code chapter 542, Cybersecurity Program
2. Law text S.B. 2610, 89th Legislature — enrolled text
3. Guidance S.B. 2610 — bill history

1. TX BC 521

   Texas's duty to protect sensitive personal information and notify breaches; chapter 542 only limits exemplary damages in breach litigation.

2. CIS Controls

   The control set whose Implementation Group 1 is the stated baseline for Texas businesses with 20 to 99 employees.

3. NIST CSF

   One of the frameworks a program may conform to; chapter 542 attaches a liability limit to that conformity.

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 20 September 2026. Subscribe to TX SB 2610 (RSS)