Guide
TDPSA Duties and Data Protection Assessments
The Texas Data Privacy and Security Act in one reference: who is covered, what controllers and processors owe, and how it is enforced.
The TDPSA regulates covered controllers and processors. Its principal duties concern consumer rights, limited collection and use, security, transparency, processor contracts, and assessments of higher-risk processing.
Coverage and consumer rights
Start with section 541.002 and its entity and information exclusions. Texas does not impose a general revenue floor; the small-business exclusion incorporates the SBA definition, subject to the residual sensitive-data-sale duty. Consumers may request access, correction, deletion, and specified portability, and may opt out of sale, targeted advertising, and qualifying significant-decision profiling. Portability covers data previously provided by the consumer, rather than every inference the controller generates. §§ 541.002-.003, 541.051, 541.107.
Responses ordinarily are due within 45 days, with one reasonably necessary 45-day extension and timely notice. Appeals require a written decision within 60 days. These periods are distinct from the Attorney General's cure period. §§ 541.052-.053.
Controller and processor duties
Controllers must limit collection to information adequate, relevant, and reasonably necessary for disclosed purposes and maintain appropriate reasonable security. An incompatible additional purpose generally requires consent. Sensitive-data processing requires consent, with a COPPA rule for known children's data. Notices must describe categories, purposes, rights, appeals, and relevant sharing; sale and targeted advertising need conspicuous disclosure and an opt-out explanation. §§ 541.101-.103.
Processors must follow instructions and assist with requests, security, breach notice, and assessments. HB 149 amended section 541.104(a)(2), effective January 1, 2026, to expressly include applicable personal data collected, stored, and processed by an AI system. The amendment does not turn every AI vendor into a processor: the role depends on the actual processing relationship. Required contracts address instructions, purpose, data type, duration, confidentiality, return or deletion, compliance information, assessments, and subcontractors. § 541.104.
What an assessment must decide
Section 541.105 requires documented assessments for targeted advertising, sale, sensitive-data processing, specified risky profiling, and processing presenting heightened harm. The assessment weighs benefits against consumer risks and safeguards, considering expectations, context, deidentification, and the relationship with the consumer. Comparable operations may share an assessment; an assessment under another law can qualify if its scope and effect are reasonably comparable. HB 4 section 4 applies the assessment duty to processing activities generated after the Act’s effective date and makes it nonretroactive. HB 4, § 4.
For example, a software company introducing a location-based advertising feature should examine whether location is sensitive, obtain required consent, evaluate sale and targeting, test opt-outs, and assess the proposed feature's risks. A generic security questionnaire does not answer these privacy questions. § 541.105.
Enforcement and timing
Most duties began July 1, 2024. Section 541.055(e), permitting technology-based designation of an authorized agent for sale and targeted-advertising opt-outs, took effect January 1, 2025. Sections 541.055(e) and (f) retain specified verification and capability exceptions and require an affirmative consumer choice. HB 4, § 7; § 541.055.
The Attorney General has exclusive enforcement authority. Before an enforcement action, section 541.154 supplies a 30-day notice and cure process with written assurances and supporting documentation. Section 541.155 allows up to $7,500 per violation after the cure period or for breaching an assurance. Section 541.156 forecloses a private action based on a chapter violation. The chapter does not grant the Attorney General general substantive rulemaking power. Statutory assessments can be requested through a CID; their confidentiality and nonwaiver protection do not automatically make every underlying business record privileged. §§ 541.105(d), 541.151-.156.