What Is
What Is the Texas Cybersecurity Safe Harbor
The Texas cybersecurity safe harbor, Business and Commerce Code chapter 542, was enacted in 2025 as SB 2610 and took effect September 1, 2025. It applies only to causes of action that accrue on or after that date.
It covers a business entity in this state that has fewer than 250 employees and owns or licenses computerized data that includes sensitive personal information (§542.002). In an action arising from a breach of system security, a person harmed by the breach may not recover exemplary damages from such a business if it demonstrates that, at the time of the breach, it had implemented and maintained a cybersecurity program in compliance with the chapter (§542.003). Actual damages remain available.
A qualifying program must contain administrative, technical, and physical safeguards for personal identifying information and sensitive personal information, conform to an industry-recognized cybersecurity framework as the statute describes, and be designed to protect the security of the information, protect against any threat or hazard to its integrity, and guard against unauthorized access or acquisition that would create a material risk of identity theft or other fraud (§542.004(a)). What the program must meet depends on the business's size:
- Fewer than 20 employees: simplified requirements, including password policies and appropriate employee cybersecurity training.
- 20 to 99 employees: moderate requirements, including the requirements of the Center for Internet Security Controls Implementation Group 1.
- 100 to 249 employees: conformance to an industry-recognized framework, such as the NIST Cybersecurity Framework, NIST SP 800-171, NIST SP 800-53, the CIS Critical Security Controls, the ISO/IEC 27000 series, HITRUST CSF, the Secure Controls Framework, or SOC 2 Type 2 (§542.004(b)).
A business that is subject to HIPAA, the Gramm-Leach-Bliley Act, FISMA, or HITECH must conform to the current version of that regime, and a business to which the Payment Card Industry Data Security Standard applies must meet a current version of that standard (§542.004(b)(2), (3)). When a listed framework is revised, the program stays qualifying if the business updates it by the later of the revision's published implementation date or the first anniversary of its publication (§542.004(c)).
The safe harbor does not create a damages claim. It only bars exemplary damages in an action arising from a breach; the chapter may not be construed to create a private cause of action or to change a common law or statutory duty, so breach notice duties under §521.053 and the Attorney General's civil penalties under §521.151 are unchanged (§542.005). Because the business must demonstrate its compliance, the defense works only with records showing the program was in place and current on the day of the breach.
Pinpoint: Tex. Bus. & Com. Code ch. 542.