TEXAS DATA BREACH NOTIFICATION PACKAGE

(Consumer & Attorney General Versions)
Texas Business & Commerce Code § 521.053 Compliance

TABLE OF CONTENTS

I. Document Header
II. Definitions
III. Operative Provisions (Notice Content)
IV. Representations & Warranties
V. Covenants & Restrictions
VI. Default & Remedies
VII. Risk Allocation
VIII. Dispute Resolution
IX. General Provisions
X. Execution Block

[// GUIDANCE: This template contains two companion notices:
• “AG Notice” – required if ≥ 250 Texas residents are affected; must be submitted through the Texas Attorney General’s secure portal within 30 days of the Determination Date.
• “Consumer Notice” – required for every affected individual; must be dispatched as quickly as practicable but no later than 60 days after the Determination Date.
Complete both sections, remove guidance comments, and retain a final execution copy for your records.]

I. DOCUMENT HEADER

Document Title: Texas Data Breach Notification Letter
Sender (the “Company”): [COMPANY LEGAL NAME], a [STATE] [ENTITY TYPE], with principal place of business at [ADDRESS]
Recipients:
1. Office of the Attorney General of Texas, Consumer Protection Division (“Texas AG”) – AG Notice only
2. Affected Consumer – Consumer Notice only
Effective Date of Notice (“Notice Date”): [MM/DD/YYYY]
Governing Law: State of Texas
Venue / Forum: State courts of competent jurisdiction in [COUNTY], Texas

II. DEFINITIONS

For purposes of this Notification Package, the following capitalized terms have the meanings set forth below.

“Breach” means an unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of Sensitive Personal Information, as that term is defined in Tex. Bus. & Com. Code § 521.002(2).

“Determination Date” means the date on which the Company determined that a Breach occurred, triggering statutory notice obligations under Tex. Bus. & Com. Code § 521.053.

“Incident” means the set of events giving rise to the Breach.

“Sensitive Personal Information” or “SPI” shall have the meaning assigned in Tex. Bus. & Com. Code § 521.002(2), including but not limited to an individual’s name in combination with unencrypted or unredacted data elements such as Social Security number, driver’s-license number, or financial-account information.

“Affected Individuals” means those Texas residents whose SPI the Company reasonably believes was, or is reasonably likely to have been, compromised in the Incident.

III. OPERATIVE PROVISIONS (NOTICE CONTENT)

A. ATTORNEY GENERAL NOTICE (“AG Notice”)

[Deliver electronically via Texas AG breach-portal within 30 days of the Determination Date.]

1. Nature and Circumstances of the Breach
   • Brief Description of Incident: [INCIDENT_DESCRIPTION]
   • Date(s) of Incident: From [START_DATE] to [END_DATE]
   • Date of Discovery: [INCIDENT_DISCOVERY_DATE]
   • Determination Date: [DETERMINATION_DATE]

2. Categories of Sensitive Personal Information Involved
   • [SENSITIVE_INFORMATION_TYPES]

3. Number of Impacted Residents
   • Texas Residents: [NUMBER_AFFECTED_TX_RESIDENTS]
   • All Residents (nationwide): [NUMBER_AFFECTED_TOTAL_RESIDENTS]

4. Measures Taken to Date
   • Immediate Containment/Eradication Steps: [REMEDIATION_MEASURES_TAKEN]
   • Law-Enforcement Engagement (if any): [YES/NO & AGENCY]
   • Consumer Support (e.g., call center): [DETAILS]

5. Future Corrective Actions
   • Planned Security Enhancements: [REMEDIATION_MEASURES_PLANNED]
   • Planned Consumer Relief (credit monitoring, identity-theft insurance): [CREDIT_MONITORING_OFFER_DETAILS]

6. Copy of Consumer Notice
   • A true and correct copy of the Consumer Notice (Section III-B) is attached hereto as Exhibit A.

[// GUIDANCE: Do NOT transmit any SPI or personal data to the AG beyond the minimum necessary to comply with Tex. Bus. & Com. Code § 521.053(f).]

B. CONSUMER NOTICE (“Consumer Notice”)

[Must reach Affected Individuals no later than 60 days after Determination Date.]

[DATE]

[CONSUMER NAME]
[CONSUMER ADDRESS]

Re: Notice of Data Breach

Dear [CONSUMER NAME]:

[Paragraph 1 – What Happened]
On [DETERMINATION_DATE], [COMPANY NAME] determined that unauthorized activity in our information-technology environment resulted in a breach of certain personal information. The incident occurred between [START_DATE] and [END_DATE] and was discovered on [INCIDENT_DISCOVERY_DATE].

[Paragraph 2 – What Information Was Involved]
The information involved may have included your [SENSITIVE_INFORMATION_TYPES]. Importantly, we have no evidence at this time that your information has been misused. However, we are notifying you out of an abundance of caution and in compliance with Texas law.

[Paragraph 3 – What We Are Doing]
Upon discovery, we immediately secured our systems, engaged leading cybersecurity experts, and notified law enforcement. We have implemented the following measures to help prevent a recurrence:
• [REMEDIATION_MEASURES_TAKEN]
• [REMEDIATION_MEASURES_PLANNED]

We are also offering you [#] months of complimentary [CREDIT_MONITORING_PRODUCT] that includes identity-theft monitoring and insurance. Instructions for enrolling are enclosed in Exhibit A.

[Paragraph 4 – What You Can Do]
We encourage you to remain vigilant:
1. Review your account statements and credit reports.
2. Consider placing a fraud alert or security freeze on your credit file.
3. Contact the Federal Trade Commission or your state Attorney General for additional guidance.
Detailed consumer-protection resources are provided in Exhibit B.

[Paragraph 5 – For More Information]
If you have questions, please contact our dedicated response team toll-free at [PHONE] Monday–Friday, 8 a.m.–8 p.m. CT, or email us at [EMAIL].

We regret any inconvenience this incident may cause and appreciate your trust.

Sincerely,

[AUTHORIZED SIGNATORY]
[NAME], [TITLE]
[COMPANY NAME]
[ADDRESS]

IV. REPRESENTATIONS & WARRANTIES

1. Accuracy. The Company represents that, to the best of its knowledge after reasonable inquiry, the information contained in this Notification Package is true, complete, and not misleading as of the Notice Date.

2. Compliance. The Company warrants that it has undertaken commercially reasonable efforts to comply with Tex. Bus. & Com. Code § 521.053 and all other applicable data-breach notification laws.

3. Survival. The representations and warranties in this Section survive delivery of the notices.

V. COVENANTS & RESTRICTIONS

1. Continuing Cooperation. The Company shall reasonably cooperate with any lawful request by the Texas AG related to the Breach, subject to applicable privileges and confidentiality obligations.

2. Ongoing Notice Obligations. If additional or updated information materially affecting the accuracy of this Notice becomes available, the Company will supplement or amend the Notice without unreasonable delay.

VI. DEFAULT & REMEDIES

1. Statutory Penalties. Failure to comply with the notification requirements of Tex. Bus. & Com. Code § 521.053 may subject the Company to civil penalties of up to $100 per individual per day, among other remedies.

2. Cure Opportunity. Upon written notice from the Texas AG identifying a deficiency, the Company shall have ten (10) business days to cure the deficiency before further enforcement action, unless the AG determines that immediate action is necessary to protect consumers.

VII. RISK ALLOCATION

The Company expressly reserves all rights and defenses available under applicable law and does not, by furnishing this Notification Package, admit to any liability or waive any claim, defense, or privilege.

VIII. DISPUTE RESOLUTION

Any dispute arising out of or relating to this Notification Package shall be governed by and construed in accordance with the laws of the State of Texas, without regard to its conflict-of-law provisions, and shall be brought exclusively in the state courts located in [COUNTY], Texas.

IX. GENERAL PROVISIONS

1. Amendments. This Notification Package may be amended only in a written instrument executed by an authorized representative of the Company.
2. Severability. If any provision herein is found unenforceable, the remaining provisions shall remain in full force and effect.
3. Integration. This document constitutes the entire notification required under Tex. Bus. & Com. Code § 521.053 and supersedes any prior oral or written communications regarding the Breach.
4. Electronic Signatures. A copy bearing an electronic or facsimile signature shall be deemed an original.

X. EXECUTION BLOCK

Executed on the Notice Date by the undersigned duly authorized officer of the Company.

[COMPANY NAME]

By: _____
Name: [AUTHORIZED SIGNATORY]
Title: [TITLE]
Date: [MM/DD/YYYY]

EXHIBIT A – Consumer Enrollment Instructions for Complimentary Credit Monitoring

[Detailed step-by-step instructions, enrollment code, deadlines, and FAQs.]

EXHIBIT B – Consumer Protection Resources

• Federal Trade Commission: IdentityTheft.gov | 1-877-438-4338
• Texas Attorney General Consumer Protection Hotline: 1-800-621-0508
• Major Credit Bureaus – Contact Information and Security-Freeze Procedures

[// GUIDANCE: Remove exhibits if not offering credit monitoring, but include a statement explaining why under Tex. Bus. & Com. Code § 521.053(b)(3).]