What Is
What Is the TDPSA
The Texas Data Privacy and Security Act (TDPSA), Business and Commerce Code chapter 541, is Texas's comprehensive consumer privacy law. It was enacted as HB 4, signed June 18, 2023, and took effect July 1, 2024; its universal opt-out provision took effect January 1, 2025. It applies to a person that conducts business in Texas or produces products or services Texas residents consume, processes or sells personal data, and is not a small business as defined by the U.S. Small Business Administration (§541.002(a)); small businesses still need consent before selling sensitive data (§541.107). The chapter does not apply to everyone who otherwise meets that test: it exempts state agencies and political subdivisions, financial institutions and data subject to the Gramm-Leach-Bliley Act, HIPAA covered entities and business associates, nonprofit organizations, institutions of higher education, and electric utilities, power generation companies, and retail electric providers (§541.002(b)).
Consumers may confirm, access, correct, delete, and port their data and opt out of targeted advertising, sales, and profiling in furtherance of decisions producing legal or similarly significant effects (§541.051). A controller must respond without undue delay and no later than 45 days after receiving the request; it may extend the period once by an additional 45 days only when reasonably necessary, taking into account the complexity and number of the consumer's requests, and only if it informs the consumer of the extension, with the reasons, within the original 45-day period (§541.052).
The Attorney General enforces the law exclusively (§541.151), must give 30 days to cure (§541.154), and may seek civil penalties of up to $7,500 per violation (§541.155). HB 149 amended the processor provisions effective January 1, 2026 (§541.104(a)(2)).
Pinpoint: Tex. Bus. & Com. Code ch. 541. Related term: Personal data (TDPSA).