Tracker record · Texas · Statute
Texas breach notification duties
Texas breach notification duties are set by section 521.053. Individual notice: a person that conducts business in Texas and owns or licenses computerized data including sensitive personal information must notify any individual whose sensitive personal information was or is reasonably believed to have been acquired by an unauthorized person, without unreasonable delay and not later than 60 days after the date the person determines that the breach occurred; the statute permits delay at the request of a law enforcement agency and the time necessary to determine the scope of the breach and restore the data system's reasonable integrity, and allows notice under another state's law for residents of that state (secs. 521.053(b), (b-1), (d)). Attorney General notice: a separate duty, triggered when a breach involves at least 250 Texas residents, requires notice to the Attorney General as soon as practicable and not later than 30 days after determination, submitted electronically on the Attorney General's form with the contents the statute specifies (sec. 521.053(i)). Timing, recipient classes, content, and exceptions are provision-specific; the Texas-focused breach notification resource carries the working chart.
Status
- Legal status
- In effect: individuals within 60 days; Attorney General within 30 days when 250 or more Texans are affected
- Allegation or finding
- Operative law
- Applicability
- Persons conducting business in Texas that own or license computerized data including sensitive personal information
- Enforceability
- Binding on parties within scope
- Effective date
- Current text September 1, 2023 (SB 768)
- Law checked through
- October 12, 2026
- Primary-source pinpoint
- §521.053
- Primary source
- https://tcss.legis.texas.gov/resources/BC/htm/BC.521.htm
- Citation
- §521.053
- Source
- Tex. Bus. & Com. Code ch. 521
Related guides
- Texas Breach Notification
- Federal and Multistate Breach Duties
- Incident Response, Ransomware, and Recovery