TX SB 820
Texas School District Cybersecurity Law (SB 820, Education Code § 11.175) — Texas Legislature
Also known as: SB 820, Texas school cybersecurity law, Education Code 11.175
Official site Official change log Subscribe to TX SB 820 (RSS)
At a glance
- Current version
- Education Code § 11.175 (as amended by H.B. 150 and H.B. 3512, 2025)
- Published 1 September 2025. source
- Status
- In force
- Next deadline
- None announced
- Who must comply
- Texas school districts; the duty to report breaches of student information also covers open-enrollment charter schools. source
- How it is assessed
- Districts set their own policy, which must not conflict with the state's security standards for higher education, and report breaches to the agency. source
- Authority
- A Texas statute (Education Code section 11.175); reports go to the Texas Education Agency, and the commissioner of education adopts rules to implement it. source
- Last change
- None recorded yet
Every Texas school district must adopt a cybersecurity policy, designate a cybersecurity coordinator as liaison to the state education agency, and report any breach of student information to that agency and to the parents of affected students. One of the few US statutes to put named cyber duties on school districts rather than on businesses.
Recent changes
No changes recorded yet — we are watching, and nothing has been published.
Key dates
No upcoming datesAmendments
-
Education Code § 11.175 (as amended by H.B. 150 and H.B. 3512, 2025) AmendmentCurrent text
Two 2025 acts took effect: H.B. 150 moved the cross-references to the Texas Cyber Command, and H.B. 3512 added artificial intelligence training next to cybersecurity training. source
More
- H.B. 150 (Section 19): a district's cybersecurity policy may not conflict with the security standards for higher education adopted by the Texas Cyber Command rather than the Department of Information Resources.
- H.B. 3512 (Section 1): only the district's cybersecurity coordinator must complete the cybersecurity and the artificial intelligence training annually; other employees train as the district determines.
-
H.B. 4595 (2023) Amendment
A nonsubstantive revision act redesignated subsection (g) added by S.B. 1267 as subsection (h-1). source
-
S.B. 1696 (2021) Amendment
Renamed the section "School Cybersecurity", extended breach reporting to open-enrollment charter schools and created a system for anonymous sharing of incident information. source
More
- The Texas Education Agency, with the Department of Information Resources, maintains a system for anonymous sharing of reported attacks and incidents between participating schools and the state.
-
S.B. 1267 (2021) Amendment
Provided that only the district's cybersecurity coordinator must complete the state cybersecurity training every year. source
-
S.B. 820 (2019) Major version
Added section 11.175, requiring each district to adopt a cybersecurity policy, designate a cybersecurity coordinator and report breaches of student information. source
Who it applies to
Every Texas school district, with breach reporting extended to open-enrollment charter schools.
- Cybersecurity policy
- Each school district adopts a cybersecurity policy to secure district cyberinfrastructure and to determine cybersecurity risk and implement mitigation planning. source
- Coordinator
- The superintendent designates a cybersecurity coordinator as liaison between the district and the Texas Education Agency. source
- Breach reporting
- A district or open-enrollment charter school reports any attack or incident that is a breach of system security to the agency as soon as practicable after discovery. source
- Parent notice
- The coordinator notifies the parent of a student whose information was involved in a reportable attack or incident. source
- Training
- Only the cybersecurity coordinator must complete the state cybersecurity and artificial intelligence training annually; other employees train as the district determines. source
How compliance is assessed
Districts set their own policy, which must not conflict with the state's security standards for higher education, and report breaches to the agency.
- Consistency
- A district's cybersecurity policy may not conflict with the information security standards for institutions of higher education adopted by the Texas Cyber Command. source
- Incident sharing
- Reports are included in an anonymous sharing system run by the agency in coordination with the Department of Information Resources, which may be contracted out. source
Enforcement and penalties
Implemented through rules adopted by the commissioner of education.
- Rules
- The commissioner shall adopt rules as necessary to implement the section. source
Documents
Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 20 September 2026. Subscribe to TX SB 820 (RSS)