Skip to main content

On-demand webinar coming soon...

Blog

Data Privacy and Security Act passed in Texas

The consumer privacy bill now awaits the Governor’s signature before becoming the fifth state to have a comprehensive privacy act signed into law in 2023

Robb Hiscock
Senior Content Marketing Specialist, CIPP/E, CIPM, OneTrust
May 31, 2023

Texas capitol building with American and Texas flags blowing in the wind

On May 28, 2023, the Texas Data Privacy and Security Act (TDPSA) was passed and later signed by the Texas State House and Senate. It has been sent to Governor Greg Abbott for signature before becoming law. Assuming the TDPSA does pass into law, it will be the fifth comprehensive privacy act to become law in 2023 and the tenth piece of the patchwork of US state privacy laws. 

While the TDPSA holds many similarities to existing state privacy laws – consumer rights, opt-in consent for sensitive data, and data protection assessments – it also contains several provisions, including enhance disclosure requirements and a broader scope of application, that organizations should be aware of ahead of an expected effective date of July 1, 2024. 

 

Key areas of the Texas Data Privacy and Security Act

The TDPSA widely aligns with the Virginia Consumer Data Protection Act (CDPA) but has some key differences to this and other existing US state privacy laws. Notably a broader scope of application will envelope businesses outside of Texas and that does not cover non-profits or make additional protections for Children’s data. Let’s take a closer a look at some of the key areas of the TDPSA. 

 

Scope of application 

The TDPSA has a broad scope of application including an extra-territorial application that will bring organizations outside of Texas into scope for certain processing activities. 

The TDPSA will apply to organizations that:

  • Do business in the state of Texas or produce products or services that are consumed by residents of Texas
  • Process or engage in the sale of personal data
  • Are not a small business as defined by the United States Small Business Administration

Unlike other US state laws, the TDPSA does not contain a specific monetary application threshold or one related to the number of consumers’ data must be controlled or processed. Instead it introduces a small business exception as defined by the United States Small Business Administration, which varies by annual turnover, employee count, and industry.

As with many US state privacy laws, the TDPSA includes exemptions for organizations that are covered by sectoral privacy laws including the Health Insurance Portability and Accountability Act (HIPAA) and the Gramm-Leach-Bliley Act (GLBA), as well as exemptions for certain organizations (e.g. state government agencies) and specified types of information (e.g. research data).

 

Enhanced disclosure requirements

As with most modern privacy laws, the TDPSA includes transparency requirements that will obligate organizations to disclose certain information about their personal data processing activities to the consumer through a “reasonably accessible and clear” privacy notice. However, the TDPSA also includes enhanced notice requirements when an organization sells sensitive or biometric data, or sells personal data to a third party for targeted advertising. 

All organizations covered by the TDPSA will be required to present the consumer with a privacy notice that contains information relating to: 

  • The categories of personal data processed, include any sensitive data, where applicable
  • The purpose for processing personal data
  • How consumers may exercise their consumer rights 
  • The categories of personal data shared with third parties
  • The categories of third parties that personal data is shared with 
  • How consumers can exercise their consumer rights under the TDPSA

In addition to general privacy notice obligations, if an organization sells sensitive data, it will be required to make a further disclosure to consumers by including “NOTICE: We may sell your sensitive personal data" within their privacy notice. There is also a similar obligation for the sale of biometric data that requires organizations to include "NOTICE: We may sell your biometric personal data" within their privacy notice. 

Organizations that sell personal data for the purposes of targeted advertising will also need to make additional disclosures to individuals in the form of clear and conspicuous notice as well as a method for opting out of the sale. 

 

Consumer rights

Consumer rights under the TDPSA are mostly similar to what we already see in other states with Texas sitting on the more prescriptive end of the spectrum. Consumers in Texas will be able to exercise the following rights: 

  • Right to confirm processing 
  • Right to access
  • Right to correction
  • Right to deletion
  • Right to data portability
  • Right to opt-out of:
  • Targeted advertising
  • The sale of personal data
  • Profiling

Although not explicitly called out as consumer rights, consumers will have the ability to appeal decisions made by the data controller as well as the right to non-discrimination. 

Organizations will have 45 days to respond to a verifiable consumer request with the possibility of a 45-day extension.

 

Data Protection Assessments

The TDPSA contains requirements for organizations to conduct Data Protection Assessments. Again, the requirement is similar to that found under other US state privacy laws and organizations must balance the benefits of the processing activity against the potential risks that it may pose to individuals. 

In particular, organizations will be required to conduct and document a data protection assessment for the follow processing activities: 

  • Processing of personal data for purposes of targeted advertising
  • Selling personal data
  • Processing of personal data for purposes of profiling 
  • Processing sensitive data
  • Processing activities involving personal data that present a heightened risk of harm to consumers

The TDPSA does offer a more business-friendly approach to data protection assessments, not widely seen in US state privacy laws, by highlighting that a single data protection assessment may address a comparable set of processing operations and that data protection assessment conducted in compliance with other laws or regulations may satisfy requirements under the TDPSA if the processing activities are comparable. 

 

How will the TDPSA be enforced?

Once effective, the TDPSA will be exclusively enforced by the Texas Attorney General. The Attorney General will have the authority to instigate investigations into potential violations of the TDPSA where copies of Data Protection Assessment can be requested and checked to ensure compliance with the law. 

Organizations that are found to be in violation of the TDPSA will have a 30-day cure period to remedy any such violation. If after 30 days, no remediation has taken place the Attorney General can issue civil up to $7,500 for each violation.

The TDPSA does not provide a private right of action.

 

How can OneTrust help get you prepared for the TDPSA?

Pending the Governor’s signature, organizations that will fall under the TDPSA will have just over 12 months to prepare for its entry into effect and as the TDPSA does not contain a rulemaking provision, organizations can begin to prepare against the provisions contained in the act in its current form. 

The OneTrust Privacy & Data Governance Cloud offers a range of solutions that can get your privacy program up to speed with the requirements of the TDPSA. OneTrust DataGuidance Research includes news and resources from a network of expert local contributors to keep you up to date with the latest developments in US privacy. OneTrust Privacy Notice Management will help you to prepare for the TDPSA’s enhance disclosure requirements to ensure that you can presented individuals in Texas with the correct notices for how their personal data is being used. Additionally, the PIA & DPIA Automation solution can help you with the TDPSA’s data protection assessment requirements by offering a range of US privacy specific assessment templates as well as giving you the ability to document the assessment for auditing purposes should you need to present them to the Attorney General. 

Request a demo to learn more about how OneTrust can help get you started on your journey toward compliance with the Texas Data Privacy and Security Act and other US state privacy laws.  


You may also like

Webinar

Privacy Management

Federal US privacy bill on the horizon? Exploring the draft APRA & new state privacy legislation

Join OneTrust DataGuidance and expert contributors for an overview of the Kentucky Consumer Privacy Act (KCPA), Maryland's Senate Bill 0541, and the draft American Privacy Rights Act and explore how a federal bill could shape the US privacy landscape.

April 23, 2024

Learn more

Webinar

Privacy Management

Spring into action! Navigating CPRA: Ensuring compliance and protecting privacy

Join us for an interactive webinar we dive into the CPRA, which will go into force on March 29th.

March 21, 2024

Learn more

Webinar

Privacy Management

The road to 50 states: New Jersey and New Hampshire join the US privacy landscape

oin OneTrust DataGuidance for a webinar highlighting the key requirements within the new US laws, New Jersey Senate Bill 332 and New Hampshire Senate Bill 255.

February 01, 2024

Learn more

Webinar

Privacy Automation

Embedding Privacy by Design through PIA Automation

Join us for a webinar on Embedding Privacy by Design through PIA Automation.

January 11, 2024

Learn more

Webinar

Privacy Management

Automating fulfillment of subject rights requests in the US

Learn how Privacy Rights Automation helps to fully automate privacy rights requests. 

December 06, 2023

Learn more

Webinar

Privacy Management

December's deadline: Ensuring compliance with Utah's privacy regulation

Join us for a webinar as we explore the impending implementation of the Utah Privacy Law, set to take effect on December 31, 2023.

November 14, 2023

Learn more

Webinar

Privacy Management

The road to privacy compliance: A spotlight on Oregon & Delaware legislation

We explore the new Oregon and Delaware privacy laws, how they differ from other US privacy laws, and what they mean for your business.

September 14, 2023

Learn more

Regulation Book

Privacy Management

Utah Consumer Privacy Act law book

Download the Utah Consumer Privacy Act law book and have the official UCPA text at your fingertips for when the law takes effect on December 31, 2023.

September 04, 2023

Learn more

Blog

Privacy Management

The road to 50 states: Delaware and Oregon join the US privacy landscape

Get in-depth analysis on two upcoming US Privacy laws, the Oregon Consumer Privacy Act (OCPA) and the Delaware Personal Data Privacy Act (DPDPA), with OneTrust DataGuidence and a panel of experts.

August 10, 2023

Learn more

Resource Kit

Privacy Management

EU-US Data Privacy Framework resource kit

Download our EU-US Data Privacy Framework resource kit to better understand the new aggreement for cross-border personal data transfers and how to educate your stakeholders.

July 20, 2023

Learn more

Resource Kit

Privacy & Data Governance

US privacy resource kit

Download our US privacy resource kit designed to access a range of materials to help you understand how the US privacy landscape is evolving.

July 13, 2023

Learn more

Webinar

Privacy Management

Now in effect: Colorado and Connecticut privacy laws

In this free webinar, our privacy experts delve into the new Colorado and Connecticut privacy laws and how they differ from other US state regulations.

July 12, 2023

Learn more

Webinar

Privacy Management

New states, new dates: Preparing for Indiana, Montana, Tennessee and Florida state privacy laws

Join our expert panel where we examine upcoming privacy legislation in Indiana, Montana, Tennessee, and Florida and the key requirements of each law.

June 20, 2023

Learn more

Infographic

Consent & Preferences

Navigating Google's new CMP requirements

Adapt to Google's June 2023 CMP requirements with this infographic and confidently engage your audience while staying compliant.

June 20, 2023

Learn more

Webinar

Privacy Automation

US privacy laws on the horizon: Which states will be next?

Join our live webinar as OneTrust DataGuidence and privacy experts examine new privacy legislation in Indiana, Montana, Tennessee, Florida, and Texas.

June 15, 2023

Learn more

eBook

Consent & Preferences

The ultimate guide to consent and preferences for marketers

Download this eBook and learn how marketers can apply consent and preference principles to build a relationship with their audience built on trust.

June 02, 2023

Learn more

Regulation Book

Privacy Management

Colorado Privacy Act law book

The Colorado Privacy Act (CPA) comes into force on July 1. Get the law's official text right at your fingertips.

May 30, 2023

Learn more

Webinar

Privacy Management

Understanding Washington's My Health My Data Act

The Washington My Health My Data Act was signed into law on April 27, 2023 and will be enacted the following year. Join OneTrust DataGuidance and a team of legal experts and get the knowledge you need for compliance.

May 18, 2023

Learn more

Webinar

Privacy & Data Governance

Operationalizing the Iowa Consumer Data Protection Act

Join the Privacy experts at OneTrust for an update on the new law and learn key requirements of Iowa’s new privacy law and more.

May 16, 2023

Learn more

White Paper

AI Governance

Navigating responsible AI: A privacy professional's guide

Download our white paper and learn how privacy teams help organizations establish and implement polices that ensure AI applications are responsible and ethical. 

May 03, 2023

Learn more

Blog

Privacy & Data Governance

Comparing US privacy law exemptions infographic

Learn how to navigate the new US privacy law exemptions and see how they compare.

May 01, 2023

Learn more

Webinar

Privacy & Data Governance

Automate subject rights requests for compliance with US state privacy laws

Join this interactive webinar to learn how OneTrust Privacy Rights Automation helps you to fully automate privacy rights requests for your organization.

April 19, 2023

Learn more

Webinar

Privacy & Data Governance

Iowa joins US privacy landscape with a new law

OneTrust DataGuidance’s webinar discusses Iowa’s CDPA, its similarities to other US privacy laws, its implications on organizations, and steps for compliance.

April 10, 2023

Learn more

Webinar

Privacy & Data Governance

USA biometric laws: Key considerations and emerging trends

Biometric laws are emerging, and companies must ensure compliance to avoid hefty fines. Join the OneTrust DataGuidance panel of experts to learn more.

April 06, 2023 1 min read

Learn more

Infographic

Privacy Management

US privacy in 2023: Top 3 compliance priorities

Businesses at different stages of privacy maturity will need to approach US privacy compliance in different ways. Download the infographic to learn more.

March 08, 2023

Learn more

Webinar

Privacy & Data Governance

Assess privacy risk for compliance with US state privacy laws

Join this US Privacy Demo Series webinar to see a live demo of the OneTrust privacy risk or data protection assessments (PIA's) automation solution.

March 01, 2023

Learn more

Webinar

Privacy Automation

US Privacy Masterclass - Employee rights fulfilment

Learn the steps you can take to boost employee trust in compliance with US Privacy Laws in our US Privacy Masterclass on Employee Rights Fulfilment.

February 07, 2023

Learn more

Webinar

Privacy Automation

US Privacy Masterclass - Consumer rights & opt-outs

Join us in our US Privacy Masterclass as we delve into the evolving US privacy landscape and how you can build a trust-based privacy program in 2023.

February 07, 2023

Learn more

Webinar

Privacy Automation

US privacy masterclass - risk and DPIAs

Join us in our US Privacy Masterclass on Risk and DPIAs to understand the operational components for risk assessments/data protection assessments.

February 06, 2023

Learn more

Webinar

Privacy Automation

US privacy masterclass - retention & minimization

Our US Privacy Masterclass on Retention & Minimization will help you understand data policy requirements across US Privacy Laws.

February 06, 2023

Learn more

Webinar

Privacy Management

Data Privacy Day: Protiviti & OneTrust

Join industry experts at OneTrust & Protiviti for an operational deep dive and interactive Q&A on the upcoming US State laws set to go into effect in 2023.

January 26, 2023

Learn more

Checklist

Privacy Management

7 steps to CPRA compliance

Download this checklist to make sure your organization follows the right steps to implement processes that achieve California Privacy Rights Act compliance.

January 24, 2023

Learn more

eBook

Consent & Preferences

The ultimate guide to US opt-out requirements

Learn about the different opt-out requirements, such as a “Do Not Sell My Personal Information” in the US privacy landscape, and how to comply with them.

January 23, 2023

Learn more

eBook

Privacy & Data Governance

The ultimate guide to US privacy

Learn more about the three priorities for managing US privacy requirements, including addressing the most visible aspects of US privacy compliance.

December 12, 2022

Learn more

Webinar

Privacy Management

Expanded US consumer rights: What’s new and what should you do?

Join our experts to understand the operational impact of these newly-expanded US consumer rights and how to automate consumer rights request fulfillment.

August 25, 2022

Learn more

Webinar

Privacy Management

Privacy risk assessments in the US: Why, when, and what?

In this webinar, OneTrust experts discuss requirements for conducting PIAs: why they exist, when you should do them, and what they should include.

August 24, 2022

Learn more

Webinar

Privacy & Data Governance

A US federal privacy bill is on the horizon: get to know the ADPPA webinar

In this session, legal experts Michelle Schaap and Andy Lee are joined by OneTrust DataGuidance to provide an overview of what the ADPPA entails.

August 17, 2022

Learn more

Webinar

Privacy Management

Establishing and enforcing retention policies

Attend our webinar, "Establishing and enforcing retention policies," part of the US Privacy Laws Masterclass Series.

July 27, 2022

Learn more

eBook

Privacy & Data Governance

How to comply with the CCPA opt-out requirement

Download this guide to learn how you can comply with the CCPA's opt-out requirements to get on the right track to CCPA compliance.

July 22, 2022

Learn more

White Paper

Privacy & Data Governance

How OneTrust helps with California privacy law compliance (CCPA & CPRA)

This guide to California privacy law compliance helps your organization understand the requirements under the CCPA and CPRA.

June 23, 2022

Learn more

Webinar

Privacy Management

Utah and Connecticut: Latest additions to the US Privacy landscape

Watch our webinars on the latest privacy laws from Utah and Connecticut and what you need to know to prepare in 2023.

June 17, 2022

Learn more

Webinar

Privacy & Data Governance

US privacy laws & regulations: answering your biggest questions

Join us for a Q&A on the several US state laws going in effect in 2023.

June 16, 2022

Learn more

eBook

Privacy & Data Governance

Comparing US state privacy laws

Download this eBook and explore the key areas of US state privacy laws and how they compare. 

June 15, 2022

Learn more

Resource Kit

Privacy Management

Your US privacy masterclass resource kit

These resources provide key information on US privacy law through blogs, webinars, and eBooks.

April 26, 2022

Learn more

Checklist

Privacy & Data Governance

6 step checklist for compliance with US privacy laws

Download our six step checklist for US privacy laws and ensure that your company remains compliant in 2023.

March 29, 2022

Learn more

Webinar

Privacy & Data Governance

Utah joins the US Privacy landscape with new comprehensive law

Join us for an overview of Utah's Consumer Privacy Act (UCPA) and its impact on your organization.

March 25, 2022

Learn more

Webinar

Privacy Management

Overview: Understanding the trio of US privacy laws

Attend our webinar, to better understand privacy laws in the US.

March 23, 2022

Learn more

Webinar

Privacy Management

New to US privacy: Privacy impact assessments

Watch our webinar as we discuss privacy impact assessments and how they relate to US privacy laws.

March 23, 2022

Learn more

Webinar

Privacy Management

Navigating opt-out of sale vs. share

Watch our US Privacy Law masterclass to  learn about opt-out of sales and share requirements and best practices for approaching compliance.

March 23, 2022

Learn more

Webinar

Privacy Management

US Privacy series: Effectively governing personal and sensitive personal information part 3

Watch our webinar on US privacy laws and gain insight on effective personal information managment strategies.

February 02, 2022

Learn more

Webinar

Privacy Management

US Privacy series: Effectively governing personal and sensitive personal information part 2

Join us for an overview of US privacy laws and strategies for dealing with compliance.

January 11, 2022

Learn more

Webinar

Privacy Management

[Part 1] US Privacy Series: Establishing a foundation for compliance

In the first part of our US Privacy Series, we discuss US privacy laws such as the CPRA and best practices towards compliance. 

December 21, 2021

Learn more

Infographic

Privacy & Data Governance

Employee rights under the CPRA

Download our infographic on employee rights under the CPRA to help prepare for the law's expansion in CPRA. 

December 07, 2021

Learn more

eBook

Privacy & Data Governance

The ultimate guide to CCPA compliance

The Ultimate Guide to CCPA Compliance eBook highlights key compliance areas of  the CCPA that you should consider when building a privacy program.

December 01, 2021

Learn more

eBook

Privacy & Data Governance

Download this eBook for an overview of the Virginia Consumer Data Protection Act (CDPA) to understand what it means for organizations.

Download this eBook for an overview of the Virginia Consumer Data Protection Act (CDPA) to understand what it means for organizations.

July 22, 2021

Learn more

Webinar

Privacy & Data Governance

CCPA compliance masterclass

Watch our OneTrust CCPA Masterclass Series and learn how to prepare your organization for CCPA compliance.

Learn more

Webinar

US Privacy Masterclass: Countdown to 2023 compliance

Join this US Privacy Masterclass series as we delve into the evolving US privacy landscape and how you can build a trust-based privacy program in 2023.

Learn more

Webinar

Privacy Management

US Privacy Masterclass 2022

Watch the OneTrust US Privacy Masterclass series and gain insight on the major US privacy law and best practices.

Learn more