How long do I have to notify Texas residents after a data breach?
Without unreasonable delay, but not later than 60 days after determination of breach
Do I have to notify the Texas Attorney General?
Yes — within 30 days if 250 or more Texas residents are affected (one of the lowest thresholds nationally); submit via the AG's online portal
Does Texas require notification to nationwide consumer reporting agencies?
Yes — if more than 10,000 residents, notify nationwide CRAs
Is encrypted data exempt from Texas's breach notification requirement?
Yes — Texas has an encryption safe harbor. Breaches of properly encrypted personal information generally do not trigger notification, provided the encryption key was not also compromised.
Can Texas residents sue me directly for a data breach?
No — Texas's breach statute does not provide a direct private right of action. Residents typically must rely on the AG to enforce, or pursue common-law negligence claims.
What counts as 'personal information' under Texas law?
First name/initial + last name with SSN, DL/state ID, financial account + access code, plus medical information and identifying biological/biometric information; AND sensitive PI under TDPSA includes racial/ethnic origin, religious beliefs, genetic data, citizenship, precise geolocation, child data
What are the penalties for failing to comply with Texas's breach notification law?
Up to $100 per affected individual per day late, capped at $250,000 per breach; TDPSA: up to $7,500 per violation + injunctive relief