Governance, risk & compliance

Texas Data Privacy and Security Act (TDPSA) B&C Code ch. 541, in force 1 July 2024

Texas Data Privacy and Security Act (TDPSA), Business & Commerce Code ch.

541, in force 1 July 2024 (HB 4). It applies to a person that does business in Texas or makes a product or service consumed by Texans, processes or sells personal data, and is not a small business as the U.

S. Small Business Administration defines it; a small business may still not sell sensitive data without the consumer’s prior consent (s.

541. 107).

It does not apply to state agencies and political subdivisions, financial institutions and data under GLBA Title V, HIPAA covered entities and business associates, nonprofits, higher education, or certain electric utilities (s. 541.

002(b)), and it exempts several kinds of data (s. 541.

003). “Consumer” excludes people acting in a commercial or employment context (s.

541. 001), so staff and business-to-business data are outside it.

Controllers must answer rights requests (access, correct, delete, portable copy, and opt out of targeted advertising, sale and significant-decision profiling) without undue delay and within 45 days, extendable once by 45 days with notice (s. 541.

052); offer an appeal and answer it within 60 days (s. 541.

053); offer two or more request methods (s. 541.

055); limit collection and keep reasonable security (s. 541.

101(a)); obtain consent before processing sensitive data (s. 541.

101(b)(4)); publish a privacy notice, and use the exact wording in s. 541.

102(b)-(c) if they sell sensitive or biometric data; and document data protection assessments for targeted advertising, sale, risky profiling, sensitive data and other high-risk processing (s. 541.

105). Processors need a contract with the terms in s.

541. 104(b).

The Attorney General has exclusive enforcement authority, must give 30 days to cure, and may seek up to $7,500 per violation; there is no private right of action (ss. 541.

151-541. 156).

Section 541. 104(a)(2) was amended by HB 149 from 1 January 2026 to cover personal data processed by AI systems.

Not found: Attorney General rules or guidance beyond its overview page. General information, not legal advice.

Assessment tiers & levels Lavawall supports

Lavawall assesses Texas Data Privacy and Security Act (TDPSA) at every level below, so you can start where you are and step up as your program matures.

How Lavawall® helps you get to Texas Data Privacy and Security Act (TDPSA) compliance

Most of Texas Data Privacy and Security Act (TDPSA) comes down to technical controls you have to run and prove: keeping systems patched, hardening configuration, detecting breaches early, backing up what matters, controlling access, and keeping evidence that all of it actually happened. Lavawall® runs those controls across Windows, macOS, Linux, and Microsoft 365 / Google Workspace from one console, maps them to Texas Data Privacy and Security Act (TDPSA), and tracks your posture continuously instead of once a year at audit time.

• Assess your current state against Texas Data Privacy and Security Act (TDPSA) in the Lavawall GRC module, with the questionnaire and control set built in.
• Remediate the gaps with the same platform — automated patching, configuration fixes, backups, and access review — not a separate project.
• Evidence everything with timestamped, exportable records auditors, insurers, and clients accept.

Related

Lavawall® supports Texas Data Privacy and Security Act (TDPSA) as part of a built-in catalogue of compliance frameworks. Framework requirements are summarized for planning purposes; always confirm the current official text before certifying.