Data Breach Notice to Residents and State Authorities in Texas
At a glance
| Covered entity and service provider | Business operating in Texas with owned/licensed computerized data: notice to affected people; nonowner custodian: immediate notice to data owner/licensee (§ 521.053(b)-(c)) |
|---|---|
| Breach and covered information | Unauthorized acquisition compromising sensitive personal information; name plus listed unencrypted identifiers, or identifying health information; encrypted data counts if key obtained (§§ 521.002(2), 521.053(a)) |
| Risk screen or notice exception | Actual or reasonably believed unauthorized acquisition triggers notice; § 521.053(a)-(b) states no separate risk-of-harm waiver |
| Individuals who receive notice | Each individual whose sensitive information was or is reasonably believed acquired; another state's resident may receive notice under that state's law or Texas's (§ 521.053(b), (b-1)) |
| Individual notice deadline and clock | Without unreasonable delay; no later than day 60 after breach determination, subject to specified investigation, restoration, or law-enforcement delay (§ 521.053(b), (d)) |
| Regulator threshold and deadline | Attorney general: at least 250 Texas residents; electronic website form as soon as practicable and by day 30 after breach determination, with six listed report items (§ 521.053(i)) |
| Consumer-reporting-agency notice | If more than 10,000 persons are notified at one time, also tell each nationwide consumer-reporting agency the timing, distribution, and content, without unreasonable delay (§ 521.053(h)) |
| Individual delivery and content | Written notice to last known address, E-SIGN-compliant electronic notice, or qualifying substitute notice; § 521.053(e)-(i) itemizes AG-report content, not consumer-letter content |
| Substitute notice conditions and channels | Cost over $250,000, more than 500,000 affected persons, or insufficient contact data; then email, conspicuous website posting, or major statewide media (§ 521.053(f)) |
| Delays and alternate compliance | Law-enforcement-requested delay until notice no longer compromises investigation; compliant own-policy notice procedure can satisfy statute (§ 521.053(d), (g)) |
Requirements one by one
Covered information and breach
Section 521.002(2) covers two routes: an individual's name with specified unencrypted identifiers or account credentials, and identifying information about health, health care, or payment for care. Under § 521.053(a), an encrypted file can still count if the person who acquired it also has the decryption key. The statute excludes a worker's good-faith acquisition for the business unless the worker later uses or discloses the information without authorization.
The two determination clocks
The owner or license holder must tell affected individuals “without unreasonable delay” and by the 60th day after determining that the breach occurred (§ 521.053(b)). When at least 250 Texas residents are involved, the attorney-general report is due “as soon as practicable” and by the 30th day after that determination (§ 521.053(i)). For example, if the determination is made June 1, the outside dates are July 31 for individual disclosure and July 1 for the attorney-general report, subject to an authorized delay. Discovery and determination may occur on different days.
Attorney-general report
Section 521.053(i) requires the attorney general's website form. Its six report items include the breach's nature and circumstances, Texas-resident count, number sent direct notice, steps taken and planned, and whether law enforcement is investigating. Those report items do not become prescribed consumer-letter contents merely because both notices concern the same event.
Direct and substitute delivery
Under § 521.053(e), direct notice may be written to the last known address or electronic under the federal electronic-signature provision named there. If notice would cost more than $250,000, more than 500,000 persons are affected, or contacts are insufficient, subsection (f) permits email, a conspicuous website posting, or major statewide media. The statute lists these substitute channels as alternatives.
What trips people up
A processor's first recipient is the data owner. A person maintaining someone else's covered computerized data must notify the owner or license holder immediately after discovering the breach when the information was or is reasonably believed acquired (§ 521.053(c)). The owner or license holder then handles the individual route under subsection (b).
The reporting-agency trigger counts all people notified at once. When more than 10,000 people receive notice at one time, § 521.053(h) adds notice to each nationwide consumer-reporting agency about the timing, distribution, and content of those notices. Its threshold differs from the 250-Texas-resident threshold for the attorney general.
Investigation and police delays have different conditions. Subsection (b) allows time necessary to determine the scope and restore the system's integrity. Subsection (d) allows a law-enforcement-requested delay when the agency determines notice would impede a criminal investigation; notice must follow when the agency determines it will no longer compromise the case.
Common questions
What if the affected person lives outside Texas? Section 521.053(b-1) allows a person covered by Texas's rule to notify a resident of another state under that state's breach-notice law or under Texas's subsection (b).
Does a worker's authorized initial access always end the issue? No. The good-faith employee or agent exclusion in § 521.053(a) stops applying if the person later uses or discloses the sensitive information without authorization.
Statutes and sources
- Tex. Bus. & Com. Code § 521.002 — sensitive-personal-information definition. https://tcss.legis.texas.gov/resources/BC/htm/BC.521.htm (accessed 2026-10-14)
- Tex. Bus. & Com. Code § 521.053 — breach, notice recipients, deadlines, methods, and delays. https://tcss.legis.texas.gov/resources/BC/htm/BC.521.htm (accessed 2026-10-14)
Source links
Every statute quoted above, linked, with the date we checked it.
What does Texas law mean for your facts?
You just read the general rule. Ask your own question and see which parts of current Texas law apply to your situation, with citations you can check.
Try Ezel Pro free for 7 days. Cancel anytime before the trial ends and you pay nothing.
- Starts from the statutes this survey is built on
- Cites every source it relies on, so you can verify it
- Chat, drafting and research in one workspace