Texas Data Law

Texas Data, Privacy & AI

Insurance Cybersecurity and Texas Breach Response

A data breach at a Texas insurer can start several clocks at once: notice to affected individuals without unreasonable delay and ordinarily within 60 days after the determination that a breach occurred; a separate Attorney General notice, as soon as practicable and within 30 days after that determination, when at least 250 Texas residents are involved; a report to the Texas Department of Insurance (TDI) under its separate reporting guidance; and duties under federal and other states' law. This guide maps each one.

What the law requires

Texas has not enacted the NAIC Insurance Data Security Model Law, so it has no insurance-specific cybersecurity statute. A Texas insurer, health maintenance organization (HMO), administrator, agent, or other TDI-regulated business works instead under the general breach law, TDI's reporting guidance and examination authority, the insurance privacy rules, and federal law. Two chapters share the number 521 and should not be confused: Business and Commerce Code chapter 521 sets the breach duties, while Insurance Code chapter 521 governs consumer information and complaints.

Notice to individuals and the Attorney General. Under Business and Commerce Code §521.053, an owner or licensee conducting business in Texas must notify affected individuals whose information was or reasonably is believed acquired by an unauthorized person, without unreasonable delay and ordinarily within 60 days after determining that a breach occurred, subject to the statutory qualifications. If at least 250 Texas residents are involved, it must also notify the Attorney General on the AG's electronic form as soon as practicable and within 30 days after that determination; this is a separate clock, so do not wait for individual notices. If more than 10,000 people must be notified at once, it must also notify the nationwide consumer reporting agencies. Civil penalties run from $2,000 to $50,000 per violation, plus up to $100 per individual per day for late notice, capped at $250,000 per breach (§521.151).

Security duty. Chapter 521's general duty to maintain reasonable security procedures does not apply to a financial institution as defined by the Gramm-Leach-Bliley Act (§521.052(c)), a definition that includes insurers. The breach notice duty in §521.053 has no such exemption.

TDI reporting. TDI Bulletin B-0009-23 (July 18, 2023) asks domestic insurers and HMOs to report any unauthorized acquisition, release, or use of personal information or sensitive company information to [email protected]. Other regulated entities and individuals may send breach notices to [email protected]. The bulletin sets no deadline, but TDI may request information about the incident under its examination authority.

Other rules that apply to insurers

Insurance privacy. Insurance Code chapter 601 requires insurers to comply with federal financial privacy law, and TDI's privacy rules at 28 Texas Administrative Code chapter 22 add requirements, including for consumer health information.

HIPAA. A health plan or HMO that is a HIPAA covered entity must also notify affected individuals within 60 days of discovering a breach of unsecured protected health information, and notify the Department of Health and Human Services.

TDPSA. Data subject to the Gramm-Leach-Bliley Act is exempt from the Texas Data Privacy and Security Act (§541.002(b)(2)).

Other states. Many states have adopted the NAIC model law, which requires a licensee to notify the state insurance commissioner as promptly as possible and no later than 72 hours after determining that a cybersecurity event occurred. State versions vary, so an insurer licensed in several states should check each one.

Related topics

Sources and legal update

Current through October 13, 2026.

This material is for general information and is not legal advice. Law and enforcement practice change. Consult counsel about specific facts.