Tracker record · Texas · Statute
Texas Identity Theft Enforcement and Protection Act
Business and Commerce Code chapter 521 is the Texas home for three related duties: reasonable procedures to protect sensitive personal information, proper disposal of business records containing personal information (sec. 521.052), and breach notification (sec. 521.053). Under section 521.053(b), a person that conducts business in Texas and owns or licenses computerized data including sensitive personal information must notify any individual whose sensitive personal information was or is reasonably believed to have been acquired by an unauthorized person. Notice must be without unreasonable delay and not later than 60 days after the date the person determines that the breach occurred, subject to delay at law-enforcement request and to the time needed to determine the breach's scope and restore the data system's reasonable integrity; notice to a resident of another state may be given under that state's law (secs. 521.053(b), (b-1), (d)). Separately, section 521.053(i) requires notice to the Attorney General, as soon as practicable and not later than 30 days after determination, when a breach involves at least 250 Texas residents; the notice is submitted on the Attorney General's electronic form with the contents the statute specifies. A cybersecurity safe harbor added by SB 2610 gives organizations that implement qualifying frameworks and document them an affirmative defense with a defined scope; eligibility, evidence, and limits matter more than the label.
Status
- Legal status
- In effect (Pinpoints: §521.052 security and disposal; §521.151 penalties)
- Allegation or finding
- Operative law
- Applicability
- Persons conducting business in Texas that own or license computerized data including sensitive personal information
- Enforceability
- Binding on parties within scope
- Effective date
- April 1, 2009
- Law checked through
- October 12, 2026
- Primary-source pinpoint
- ch. 521
- Primary source
- https://tcss.legis.texas.gov/resources/BC/htm/BC.521.htm
- Citation
- Bus. & Com. Code ch. 521 (HB 2278, 2007)
- Source
- Tex. Bus. & Com. Code ch. 521
Related guides
- Reasonable Security and the Texas Cybersecurity Safe Harbor
- Incident Response, Ransomware, and Recovery
- Texas Breach Notification
- Privacy Litigation: Standing, Class Actions, and Arbitration