Tracker record · Texas · Statute
Texas cybersecurity safe harbor (SB 2610)
Business and Commerce Code chapter 542, added by SB 2610, limits exemplary damages in an action arising from a breach of system security: a person harmed by the breach may not recover exemplary damages from a Texas business entity with fewer than 250 employees that owns or licenses computerized data including sensitive personal information if the entity demonstrates that, at the time of the breach, it implemented and maintained a cybersecurity program meeting section 542.004 (sec. 542.003). A qualifying program contains administrative, technical, and physical safeguards for personal identifying and sensitive personal information, conforms to an industry-recognized cybersecurity framework, and scales to the business's size: simplified requirements (password policies and employee cybersecurity training) for fewer than 20 employees, moderate requirements including CIS Controls Implementation Group 1 for 20 to 99 employees, and full framework conformance for 100 to 249 employees (sec. 542.004(a)). Listed frameworks include the NIST Cybersecurity Framework, NIST SP 800-171, NIST SP 800-53 and 800-53a, FedRAMP, CIS Critical Security Controls, the ISO/IEC 27000 series, HITRUST CSF, the Secure Controls Framework, and SOC 2, plus sector standards (HIPAA, GLBA, FISMA, HITECH, PCI DSS) where applicable (sec. 542.004(b)). If a listed standard is updated, the program remains qualifying if updated to the new standard by the later of the standard's published implementation date or the first anniversary of publication (sec. 542.004(c)). The chapter creates no private cause of action and changes no common-law or statutory duty (sec. 542.005); actual damages remain available.
Status
- Legal status
- In effect
- Allegation or finding
- Operative law
- Applicability
- Texas businesses with fewer than 250 employees that own or license computerized data including sensitive personal information
- Enforceability
- Binding on parties within scope
- Effective date
- September 1, 2025; applies to causes of action accruing on or after that date
- Law checked through
- October 12, 2026
- Primary-source pinpoint
- ch. 542
- Primary source
- https://tcss.legis.texas.gov/resources/BC/htm/BC.542.htm
- Citation
- Bus. & Com. Code ch. 542 (SB 2610, 2025)
- Source
- Tex. Bus. & Com. Code ch. 542
Procedural events
- 2025-06-20: Signed as SB 2610, 89th Legislature
- 2025-09-01: Chapter 542 takes effect