Insight
What the Texas Cybersecurity Safe Harbor Requires a Business to Prove
Eligibility, implementation evidence, and the limits of protection from exemplary damages.
Senate Bill 2610 added chapter 542 to the Business and Commerce Code, effective September 1, 2025. When a qualifying business suffers a data breach, a person harmed by it may not recover exemplary damages if the business demonstrates that it had implemented and maintained a compliant cybersecurity program at the time of the breach (§542.003). The protection is narrow, and it goes only to a business that can prove its case.
Who qualifies
Chapter 542 applies only to a business entity in this state that has fewer than 250 employees and owns or licenses computerized data that includes sensitive personal information (§542.002). All three conditions matter: the Texas nexus, the employee count, and the data condition. A larger company gains nothing from it. Neither does a business that holds no sensitive personal information as chapter 521 defines the term.
What the program must contain
The program must contain administrative, technical, and physical safeguards for personal identifying information and sensitive personal information, conform to an industry-recognized cybersecurity framework, and be designed to protect that information and guard against unauthorized access creating a material risk of identity theft or other fraud (§542.004(a)(1) through (3)). The statute then scales the requirement to the size of the business:
| Employees | Additional scale-and-scope requirement under §542.004(a)(4) |
|---|---|
| Fewer than 20 | Simplified requirements, including password policies and appropriate cybersecurity training |
| 20 to 99 | Moderate requirements, including CIS Controls Implementation Group 1 |
| 100 to 249 | Compliance with subsection (b)'s framework requirements |
These tiers operate alongside the safeguards, framework-conformity, and program-design requirements in §542.004(a)(1) through (3). Password policies and training are included examples for the smallest tier, not a complete substitute for the rest of the statute.
A recognized framework under §542.004(b)
The recognized frameworks include the NIST Cybersecurity Framework, NIST SP 800-171, NIST SP 800-53 and 800-53A, the FedRAMP Security Assessment Framework, the CIS Critical Security Controls, the ISO/IEC 27000 series, the HITRUST CSF, the Secure Controls Framework, and SOC 2 Type 2 (§542.004(b)(1)). A business already subject to HIPAA, Title V of the Gramm-Leach-Bliley Act, FISMA, or HITECH conforms by meeting the current version of that regime. A business to which the Payment Card Industry Data Security Standard applies must meet a current version of it.
Frameworks change. The update rule applies to a standard described in subsection (b)(1): the program keeps qualifying if the business updates it to the revised standard by the later of the revision's stated implementation date or the first anniversary of the revision's publication (§542.004(c)). A program that falls behind that window stops qualifying.
What the business must prove
Chapter 542 limits exemplary damages in specified data-breach actions against qualifying businesses. The business must establish that it implemented and maintained a compliant cybersecurity program when the breach occurred. Written policies, training records, access reviews, and records of control deployment can support that showing. A policy that was never put into practice is weaker evidence than a documented, operating program.
The burden rests on the business. Both statutory verbs matter. The business must show that it put the program into operation and maintained it at the time of the breach. Policies alone do not show implementation, and a breach alone does not establish that the program failed to qualify. A business that expects to rely on chapter 542 should keep the framework it chose and the version it followed, a dated assessment of its controls against that framework, training records and password policies, records of updates made after each framework revision, and logs showing the program ran before the incident.
What the safe harbor does not do
It bars only exemplary damages. Actual damages remain available. Notice duties under §521.053 and the Attorney General's civil penalties under §521.151 are unchanged. Chapter 542 creates no private cause of action and changes no existing duty (§542.005). It reaches only causes of action that accrue on or after September 1, 2025.
The safe harbor is therefore a reason to document a program, not a shield against breach liability. The same records will help a business show it met its existing duty under §521.052 to use reasonable security procedures.
Sources
- Tex. Bus. & Com. Code ch. 542, §§542.002 through 542.005
- SB 2610, enrolled text (prospective application)