Texas Enacts New Data Security Regulations for Businesses and Expands Privacy Safeguards

Texas Implements New Data Security Legislation, Bolsters Privacy Rights for Consumers

Starting this July, Texas businesses will need to exercise greater caution in handling consumer data, as mandated by a new law coming into effect.

The Texas Data Privacy and Security Act (TDPSA), passed during the 2023 regular legislative session, grants Texas residents the right to request access to their data and understand its usage. Additionally, it mandates that consumers have the option to opt out of data collection and sales.

Rick Cantu, U.S. country manager for privacy compliance company iubenda, notes that Texas joins 19 other states in enacting such data security legislation. He emphasizes that the law not only empowers consumers with rights but also imposes obligations on businesses operating in Texas.

The law applies to individuals and businesses involved in processing or selling personal data within Texas, with certain exemptions for small businesses as defined by the U.S. Small Business Administration. However, even exempt entities are barred from selling Texas customers’ data without consent.

Cantu underscores the extensive rights afforded to Texans, enabling them to safeguard their online information and exercise their right to privacy by opting out of data sharing.

While the TDPSA does not encompass state government agencies, higher education institutions, nonprofits, and certain utility and financial entities, it imposes disclosure requirements surpassing those of standard privacy policy templates. Businesses are expected to comply fully with these obligations, particularly in promptly responding to consumer data requests.

Enforcement of the law will be overseen by the Texas Office of the Attorney General, which has established a dedicated team to address privacy-related consumer complaints. The implementation of the law is projected to incur initial costs of around $5.5 million, with subsequent annual expenses of approximately $2 million, primarily to fund the addition of 12 employees to the OAG.

The law empowers consumers to file complaints online, with potential fines of up to $7,500 per violation for entities found in breach of its provisions.