Texas Data Breach Notification Law

Notification deadline: As quickly as possible, without unreasonable delay

Enforcement: Texas Attorney General

Overview

Texas requires businesses to notify affected residents "as quickly as possible" after discovering a breach involving sensitive personal information. The state also requires businesses to implement reasonable security measures.

Who Must Be Notified

• • Affected Texas residents
• • Texas Attorney General (if 250+ residents affected)

Covered Data Types

Social Security number, Driver's license or government ID number, Financial account number with access code, Credit/debit card number, Health information, Biometric data

Notification Requirements

• • Written or electronic notice to affected individuals
• • Include description of breach and types of data involved
• • Provide contact information for the business
• • Provide contact information for credit reporting agencies
• • If 250+ affected, notify TX AG within 60 days
• • Substitute notice allowed if cost exceeds $250,000 or 500,000+ affected

Exemptions

• • Encrypted data (if key not compromised)
• • Data already publicly available
• • Entities regulated by HIPAA, GLBA (but notification required)

Penalties

Civil penalties: $2,000-$50,000 per violation. AG can seek injunction and recover investigation costs. Maximum penalty of $250,000 per breach.