# Texas — US state consumer data privacy laws: applicability thresholds by state

For Texas, law name and abbreviation is Texas Data Privacy and Security Act (TDPSA); effective date is July 1, 2024; threshold combination logic is No numeric consumer or revenue thresholds — applies to any non-small-business that processes or sells personal data; key exemptions is Small businesses as defined by the United States Small Business Administration; state agencies and political subdivisions; GLBA-regulated financial institutions; HIPAA-covered entities and business associates; nonprofit organizations; institutions of higher education; enforcement mechanism is Attorney General; 30-day cure period; civil penalty up to $7,500 per violation; no private right of action, recorded from its source on 2026-08-12.

- **State:** Texas _(our reading, not quoted from the source)_
- **Law name and abbreviation:** Texas Data Privacy and Security Act (TDPSA)
- **Effective date:** July 1, 2024
- **Threshold combination logic:** No numeric consumer or revenue thresholds — applies to any non-small-business that processes or sells personal data
- **Key exemptions:** Small businesses as defined by the United States Small Business Administration; state agencies and political subdivisions; GLBA-regulated financial institutions; HIPAA-covered entities and business associates; nonprofit organizations; institutions of higher education
- **Enforcement mechanism:** Attorney General; 30-day cure period; civil penalty up to $7,500 per violation; no private right of action
- **Statute citation:** Tex. Bus. & Com. Code ch. 541
- **Notes:** Texas is unique among state privacy laws in having no specific numeric consumer or revenue thresholds. Instead, it exempts small businesses as defined by the U.S. Small Business Administration. This means the SBA size standards (which vary by industry) determine applicability rather than a fixed consumer count.

## What the source says

> APPLICABILITY OF CHAPTER. (a) This chapter 16 applies only to a person that: 17 (1)AAconducts business in this state or produces a 18 product or service consumed by residents of this state; 19 (2)AAprocesses or engages in the sale of personal data; 20 and 21 (3)AAis not a small business as defined by the United 22 States Small Business Administration, except to the extent that 23 Section 541.107 applies to a person described by this subdivision.

## Source

- https://capitol.texas.gov/tlodocs/88R/billtext/pdf/HB00004F.pdf

Last verified: 2026-08-12. Review by: 2026-11-10.
Part of [US state consumer data privacy laws: applicability thresholds by state](https://referencesource.org/state-data-privacy-applicability-thresholds/).