Question 1

Who must comply with the Texas Data Privacy and Security Act (TDPSA)?

Accepted Answer

Any person or entity that (1) conducts business in Texas or produces products or services consumed by Texas residents, (2) processes or engages in the sale of personal data, and (3) is not a small business as defined by the U.S. Small Business Administration. Nonprofits, HIPAA-covered entities, certain government contractors, and higher education institutions are exempt. The small-business exemption does NOT exempt you from the universal opt-out mechanism requirement (effective January 1, 2025).

Question 2

What are the consumer rights under the TDPSA?

Accepted Answer

Texas consumers have six rights under Tex. Bus. & Com. Code §541.051: (1) right to know whether a controller processes their personal data; (2) right to access their personal data; (3) right to correct inaccuracies; (4) right to delete personal data provided by or obtained about them; (5) right to data portability in a readily usable format; and (6) right to opt out of processing for targeted advertising, sale of personal data, or profiling for consequential decisions. Controllers must respond to verified requests within 45 days (extendable by 45 days with notice).

Question 3

What is the TDPSA universal opt-out mechanism requirement?

Accepted Answer

Effective January 1, 2025, controllers subject to the TDPSA must recognize and honor a consumer's opt-out of targeted advertising or sale of personal data communicated through a universal opt-out mechanism — such as the Global Privacy Control (GPC). This is similar to requirements under Colorado and Connecticut privacy laws. Failure to recognize GPC signals is a compliance gap the Texas AG can pursue directly.

Question 4

What is a Data Protection Assessment under the TDPSA?

Accepted Answer

Under Tex. Bus. & Com. Code §541.105, controllers must conduct a Data Protection Assessment (DPA) for processing activities that present a heightened risk of harm — including targeted advertising, sale of personal data, processing sensitive data, and profiling that could produce legal or similarly significant effects. DPAs must be documented, available to the Texas AG upon request, and reviewed periodically. A DPA conducted for similar activities may cover multiple activities.

Question 5

Does the TDPSA have a cure period?

Accepted Answer

Yes — but only until June 1, 2025. Under Tex. Bus. & Com. Code §541.152, the Texas AG must give controllers a 30-day written notice and opportunity to cure before filing suit. However, after June 1, 2025, the cure period is discretionary, not mandatory. The AG can pursue civil penalties of up to $7,500 per violation without providing a cure opportunity. Controllers with documented compliance programs are better positioned even when the cure period applies.

Are You TDPSAReady?

Are You TDPSA
Ready?