What Is
What Is a Data Protection Assessment?
A data protection assessment is the documented weighing exercise the Texas Data Privacy and Security Act requires a controller to complete before undertaking five kinds of processing: targeted advertising, sale of personal data, sensitive-data processing, specified risky profiling, and processing presenting heightened harm (Tex. Bus. & Com. Code § 541.105). The assessment sets benefits against consumer risks and safeguards, considering consumer expectations, context, deidentification, and the relationship with the consumer. Comparable operations may share one assessment, and an assessment done under another law can qualify if its scope and effect are reasonably comparable.
The duty applies to processing activities generated after the Act took effect and is nonretroactive (HB 4, § 4). The Attorney General may request assessments through a civil investigative demand, and the statute gives assessments confidentiality and nonwaiver protection (Tex. Bus. & Com. Code § 541.105(d)).
Pinpoint: Tex. Bus. & Com. Code § 541.105. Related term: Data protection assessment (TDPSA).