Texas Data Breach Notification Law: What Small Businesses Need to Do, and When
Updated: 2 days ago
By Dane Gray
Nobody plans to have a data breach. But if a criminal gets into your email, your file server, or the laptop that went missing from a truck, Texas law starts a clock. Knowing how that clock works before you need it is one of the most useful things a business owner can do.
This guide walks through what Texas law actually says, in plain language, and gives you a practical plan for the first hours after you discover a problem.
This article is general information, not legal advice. If you think you've had a breach, talk with an attorney who handles data privacy.
What counts as a data breach under Texas law?
Texas Business & Commerce Code §521.053 defines a "breach of system security" as unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of sensitive personal information. Encrypted data counts too if the person who took it also has the key.
"Sensitive personal information" (defined in §521.002) includes:
A person's first name or first initial and last name, together with an unencrypted Social Security number, driver's license or government ID number, or a financial account or card number plus the code or password needed to use it.
Information that identifies a person and relates to their physical or mental health, their health care, or payment for that care.
That covers more than most owners expect. A scanned W-2, a client intake form, a spreadsheet of employee IDs, or a mailbox full of insurance paperwork can all qualify.
One helpful exception: an employee who accesses information in good faith for business purposes is not a breach, unless they then use or share it in an unauthorized way.
What are the Texas breach notification deadlines?
There are two separate deadlines, and they are easy to mix up.
Notifying affected people: 60 days. Under §521.053(b), you must notify each person whose sensitive personal information was, or is reasonably believed to have been, taken. Notice must go out "without unreasonable delay" and no later than the 60th day after you determine the breach occurred.
Notifying the Texas Attorney General: 30 days, if 250 or more Texans are affected. Under §521.053(i), if the breach involves at least 250 Texas residents, you must also report it to the Attorney General as soon as practicable and no later than the 30th day after you determine the breach occurred. The report is filed electronically through the form on the Attorney General's website.
So the regulator deadline is the shorter one. If you hit the 250-resident mark, the Attorney General hears from you before your 60-day window for individuals runs out.
Two things are worth noticing about the wording:
"Without unreasonable delay" comes first. The 60 days is an outer limit, not a target. Waiting until day 59 when you could have notified people sooner can still be a problem.
The clock starts when you determine a breach occurred. That is a judgment you make based on facts, which is one reason good logs and a quick investigation matter so much.
What has to be in the Attorney General report?
The statute lists what the report must include:
A detailed description of the nature and circumstances of the breach, or how the information was used.
The number of Texas residents affected at the time you report.
How many of them you have already notified by mail or another direct method.
The measures you've taken in response.
The measures you plan to take next.
Whether law enforcement is investigating.
The Attorney General posts a public list of reported breaches. Your business name can end up on it, which is one more reason to handle the response carefully and honestly.
Do I have to notify the credit bureaus?
Only in larger incidents. Under §521.053(h), if you have to notify more than 10,000 people at one time, you must also tell each nationwide consumer reporting agency about the timing, distribution, and content of your notices, without unreasonable delay.
How do I notify the people affected?
Section 521.053(e) allows:
Written notice to the person's last known address, or
Electronic notice, if it meets the federal E-SIGN Act requirements.
Substitute notice (email, a conspicuous notice on your website, or statewide media) is allowed only in narrow cases, such as when the business doesn't have enough contact information or the number of people affected is extremely large.
If any affected people live in another state, Texas law lets you notify them under their own state's law instead. If you also serve clients in Colorado, for example, Colorado has its own shorter deadline for residents, so a breach plan for a two-state business needs both clocks written down.
Can law enforcement delay the notice?
Yes. Under §521.053(d), you may delay notice if a law enforcement agency determines that notifying people would impede a criminal investigation. You then notify as soon as the agency says it won't compromise the investigation. Get that request documented.
What if a vendor holds the data?
If your business maintains data that belongs to someone else (for example, you're a bookkeeper or IT provider holding a client's records), §521.053(c) says you must notify the owner of that data immediately after discovering the breach. The owner then handles notifying individuals.
Flip that around too: if a vendor holds your customers' data, your contract should say how fast they will tell you. Your clock may already be running by the time they call.
What happens if a business misses the deadline?
Texas law allows the Attorney General to seek civil penalties for violations of the chapter, plus an additional penalty for each affected person for each day notice to individuals is late, up to a cap per breach. In plain terms, delay gets more expensive the longer it goes. That's the real reason to have a plan before you need it.
What should I do in the first hours after a breach?
Here is a practical plan. Print it, or put it somewhere you can find it even if your email is down.
1. Contain it, but don't wipe anything.
Disconnect affected computers from the network, reset compromised passwords, and revoke active sign-in sessions. If it's a Microsoft 365 account, check for new inbox rules and forwarding that an attacker may have added. Don't reformat machines or delete mailboxes yet. You'll need that evidence.
2. Write down the time and what you know.
Start a simple log: when you noticed, who noticed, what you saw, and every step you take. That record helps you show when you determined a breach occurred and what you did about it.
3. Call the right people.
Your attorney, your cyber insurance carrier (many policies require prompt notice and have a list of approved responders), and your IT or security provider. If money moved, call your bank right away.
4. Preserve the evidence.
Keep logs from email, firewalls, and sign-ins. Many systems keep logs for only a limited time by default, so ask your IT provider to export them now.
5. Figure out whose data was involved.
This is the question that decides your deadlines. Was sensitive personal information in the affected systems? How many people? How many are Texas residents? Is it more than 250? More than 10,000?
6. Put the deadlines on a calendar.
Once you determine a breach occurred, mark day 30 (Attorney General, if 250+ Texans) and day 60 (individuals), and remember both are outer limits. Note any other states involved.
7. Draft notices with your attorney.
Keep the language clear and honest: what happened, what information was involved, what you're doing, and what people can do to protect themselves.
How can I get ready before anything happens?
The best breach response is one you've already rehearsed. A few steps make a big difference:
Know where sensitive data lives. You can't scope a breach if you don't know which systems hold Social Security numbers or health information.
Turn on and keep logs. Sign-in and email logs are often the only way to tell what an attacker saw.
Write a short incident response plan with names, phone numbers, and the Texas deadlines in it.
Review vendor contracts for breach-notice language.
Consider a documented security program. Texas's newer safe harbor law can limit certain damages for small businesses that maintain one. We explain it in Texas SB 2610 Explained.
For a feel of how the first hour can go well or badly, read The First Hour of a Cyberattack.
Frequently asked questions
Is the Texas breach notification deadline 30 days or 60 days?
Both, for different audiences. Affected individuals must be notified within 60 days of determining the breach occurred. The Texas Attorney General must be notified within 30 days if 250 or more Texans are affected.
Does the Texas law apply to small businesses?
Yes. Section 521.053 applies to any person who conducts business in Texas and owns or licenses computerized data that includes sensitive personal information. There's no small-business exemption to the notice duty.
Does a lost laptop count as a breach?
It can. If the laptop held unencrypted sensitive personal information and it's reasonably believed someone acquired that data, it may trigger notice. Encryption can change the answer, unless the key was also exposed.
Where do I report a breach to the Texas Attorney General?
Through the electronic data breach reporting form on the Attorney General's website.
Do I still have to notify people if the data was encrypted?
Generally, encrypted data is outside the definition, but not if the person who accessed it has the key to decrypt it.
Get your plan in place before you need it
At 24uNet, we help businesses in Bryan–College Station and across Texas set up the basics that make a breach easier to handle: sign-in protection, logging, backups, and a written plan with the right people and deadlines in it. If you'd like a second set of eyes on where you stand, start with our Security Baseline.
This article is general information about Texas Business & Commerce Code §521.053 and is not legal advice. Laws change; confirm current requirements with your attorney.
Comments