TX SB 820

Texas School District Cybersecurity Law (SB 820, Education Code § 11.175) — Texas Legislature

Also known as: SB 820, Texas school cybersecurity law, Education Code 11.175

At a glance

Current version
Education Code § 11.175 (as amended by H.B. 150 and H.B. 3512, 2025)
Published 1 September 2025. source
Status
In force
Next deadline
None announced
Who must comply
Texas school districts; the duty to report breaches of student information also covers open-enrollment charter schools. source
Authority
A Texas statute (Education Code section 11.175); reports go to the Texas Education Agency, and the commissioner of education adopts rules to implement it. source
Last change
None recorded yet

Every Texas school district must adopt a cybersecurity policy, designate a cybersecurity coordinator as liaison to the state education agency, and report any breach of student information to that agency and to the parents of affected students. One of the few US statutes to put named cyber duties on school districts rather than on businesses.

Recent changes

No changes recorded yet — we are watching, and nothing has been published.

Key dates

No upcoming dates
  1. H.B. 150 and H.B. 3512 amendments to section 11.175 take effect
  2. S.B. 1696 amendments (charter schools, incident-sharing system) take effect
  3. S.B. 820 takes effect
  4. S.B. 820 signed by the Governor

Amendments

  1. Education Code § 11.175 (as amended by H.B. 150 and H.B. 3512, 2025) AmendmentCurrent text

    Two 2025 acts took effect: H.B. 150 moved the cross-references to the Texas Cyber Command, and H.B. 3512 added artificial intelligence training next to cybersecurity training. source

    More
    • H.B. 150 (Section 19): a district's cybersecurity policy may not conflict with the security standards for higher education adopted by the Texas Cyber Command rather than the Department of Information Resources.
    • H.B. 3512 (Section 1): only the district's cybersecurity coordinator must complete the cybersecurity and the artificial intelligence training annually; other employees train as the district determines.
  2. H.B. 4595 (2023) Amendment

    A nonsubstantive revision act redesignated subsection (g) added by S.B. 1267 as subsection (h-1). source

  3. S.B. 1696 (2021) Amendment

    Renamed the section "School Cybersecurity", extended breach reporting to open-enrollment charter schools and created a system for anonymous sharing of incident information. source

    More
    • The Texas Education Agency, with the Department of Information Resources, maintains a system for anonymous sharing of reported attacks and incidents between participating schools and the state.
  4. S.B. 1267 (2021) Amendment

    Provided that only the district's cybersecurity coordinator must complete the state cybersecurity training every year. source

  5. S.B. 820 (2019) Major version

    Added section 11.175, requiring each district to adopt a cybersecurity policy, designate a cybersecurity coordinator and report breaches of student information. source

Who it applies to

Every Texas school district, with breach reporting extended to open-enrollment charter schools.

Cybersecurity policy
Each school district adopts a cybersecurity policy to secure district cyberinfrastructure and to determine cybersecurity risk and implement mitigation planning. source
Coordinator
The superintendent designates a cybersecurity coordinator as liaison between the district and the Texas Education Agency. source
Breach reporting
A district or open-enrollment charter school reports any attack or incident that is a breach of system security to the agency as soon as practicable after discovery. source
Parent notice
The coordinator notifies the parent of a student whose information was involved in a reportable attack or incident. source
Training
Only the cybersecurity coordinator must complete the state cybersecurity and artificial intelligence training annually; other employees train as the district determines. source

How compliance is assessed

Districts set their own policy, which must not conflict with the state's security standards for higher education, and report breaches to the agency.

Consistency
A district's cybersecurity policy may not conflict with the information security standards for institutions of higher education adopted by the Texas Cyber Command. source
Incident sharing
Reports are included in an anonymous sharing system run by the agency in coordination with the Department of Information Resources, which may be contracted out. source

Enforcement and penalties

Implemented through rules adopted by the commissioner of education.

Rules
The commissioner shall adopt rules as necessary to implement the section. source

Documents

  1. Law text Texas Education Code chapter 11 (section 11.175, School Cybersecurity)
  2. Law text S.B. 820, 86th Legislature — enrolled text
  3. Law text S.B. 1696, 87th Legislature — enrolled text
  4. Law text H.B. 150, 89th Legislature (Texas Cyber Command) — enrolled text

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 20 September 2026. Subscribe to TX SB 820 (RSS)