State Data Breach Notification Letter

Texas Data-Breach Notification Preparation Packet

1. Incident and Role Record

• Organization: [________________________________]
• Incident identifier: [________________________________]
• Incident discovery date and time: [__/__/____] [____:____]
• Date and time the organization determined a qualifying breach occurred: [__/__/____] [____:____]
• Decision maker and supporting investigation record: [________________________________]
• Data owner / license holder: [________________________________]
• Data custodian or service provider: [________________________________]
• Texas residents affected or reasonably believed affected: [________________________________]
• Total persons to be notified at one time: [________________________________]
• Texas counsel reviewer: [________________________________]
• Incident-response lead: [________________________________]

Select the organization's role for each affected dataset:

• ☐ Owns or licenses the computerized data and conducts business in Texas.
• ☐ Maintains computerized data owned or licensed by another person.
• ☐ Has different roles for different datasets; complete a separate row for each.

2. Texas Trigger Analysis

A. Computerized Data and Sensitive Personal Information

• ☐ The incident involved computerized data.
• ☐ The affected data includes a first name or first initial plus last name combined with an unencrypted Social Security number.
• ☐ The affected data includes a first name or first initial plus last name combined with an unencrypted driver's-license or government-ID number.
• ☐ The affected data includes a first name or first initial plus last name combined with an unencrypted financial-account or card number plus the access credential needed to reach the account.
• ☐ The affected data identifies an individual and relates to physical or mental health, health care, or payment for health care.
• ☐ The information is not excluded publicly available government information.
• ☐ Another data type is involved; Texas counsel has identified the exact current authority: [________________________________].

B. Acquisition and Compromise

• ☐ There was unauthorized acquisition, not merely an unconfirmed attempt or exposure.
• ☐ The acquisition compromised the security, confidentiality, or integrity of covered sensitive personal information.
• ☐ If affected data was encrypted, the unauthorized person had the key required to decrypt it.
• ☐ Any employee or agent acquisition was outside good-faith purposes, or the employee or agent used or disclosed the information without authorization.
• ☐ The organization documented facts supporting each checked conclusion.

Decision:

• ☐ Texas Chapter 521 resident notice is required.
• ☐ Texas Chapter 521 resident notice is not required; counsel-approved basis: [________________________________].
• ☐ The facts remain incomplete; investigation owner and next decision date: [________________________________].

3. Deadline and Delay Calendar

A. Owner / License Holder Notice by a Maintainer

If § 521.053(c) applies:

• Discovery date and time: [__/__/____] [____:____]
• Immediate notice sent to owner or license holder: [__/__/____] [____:____]
• Recipient and delivery evidence: [________________________________]

B. Affected-Individual Notice by an Owner or License Holder

If § 521.053(b) applies:

• Breach determination date: [__/__/____]
• Day 60 after determination: [__/__/____]
• Planned individual-notice date: [__/__/____]
• Basis that notice will be made without unreasonable delay: [________________________________]
• Additional time used to determine scope or restore reasonable system integrity: [________________________________]

C. Law-Enforcement Delay

• ☐ No law-enforcement delay is being used.
• ☐ A law-enforcement agency requested delay and determined notice would impede a criminal investigation.
• Agency, official, date, and written record: [________________________________]
• Date agency determined notice would no longer compromise the investigation: [__/__/____]
• Rescheduled notice date: [__/__/____]

4. Notice-Channel Screen

Select and document the authorized route:

• ☐ Written notice to the individual's last known address.
• ☐ Electronic notice meeting 15 U.S.C. § 7001.
• ☐ Existing information-security-policy notice procedure that satisfies the Texas timing requirements.
• ☐ Substitute notice after counsel confirmed at least one statutory gate:
• ☐ estimated notice cost exceeds $250,000;
• ☐ affected-person count exceeds 500,000; or
• ☐ contact information is insufficient.

For substitute notice, counsel-approved channels:

• ☐ electronic mail where addresses are available;
• ☐ conspicuous website posting; and/or
• ☐ publication or broadcast through major statewide media.

Evidence supporting the channel decision: [________________________________]

5. Texas Attorney General Reporting Screen

A. Threshold and Deadline

• ☐ The breach involves fewer than 250 Texas residents; no § 521.053(i) report is triggered on that count.
• ☐ The breach involves at least 250 Texas residents; report electronically as soon as practicable and no later than day 30 after the breach determination.
• Determination date: [__/__/____]
• Day 30: [__/__/____]
• Planned submission date: [__/__/____]
• Authorized submitting representative: [________________________________]

B. Webform Preparation

Prepare all required information before opening the form because the OAG page states that the system cannot save progress.

Operational checks:

• ☐ Submission is by an authorized agent.
• ☐ A separate webform is prepared for each separate breach.
• ☐ Potential open-record disclosure has been reviewed; no privileged or unnecessary sensitive material is included.
• ☐ The confirmation email and record number will be retained.
• ☐ A supplemental filing, if needed, will state total affected and notified consumers to date and all affected information types.

Current OAG reporting page: https://www.texasattorneygeneral.gov/consumer-protection/data-breach-reporting

6. Nationwide Consumer-Reporting-Agency Screen

• ☐ Notification is required at one time to 10,000 or fewer persons; § 521.053(h) is not triggered by count.
• ☐ Notification is required at one time to more than 10,000 persons; notify each nationwide consumer reporting agency without unreasonable delay.
• Timing, distribution, and content summary supplied to CRAs: [________________________________]
• CRA recipients, dates, and delivery evidence: [________________________________]

7. Other-Law and Contract Overlay

• ☐ Every affected person's state of residence has been identified.
• ☐ Other-state notice, content, timing, regulator, and CRA duties have been reviewed.
• ☐ Federal or sector-specific duties have been reviewed, including any applicable health, financial, education, communications, government-contractor, or critical-infrastructure rule.
• ☐ Contractual customer, insurer, cyber-policy, vendor, and law-enforcement notice duties have been reviewed.
• ☐ The organization has not assumed that Texas compliance completes every other notification duty.

Draft Affected-Individual Notice

[DATE]

[RECIPIENT NAME]
[ADDRESS]
[CITY, STATE ZIP]

Re: Notice of Data Security Incident

Dear [RECIPIENT NAME]:

What Happened

On [DETERMINATION DATE], [ORGANIZATION] determined that [concise, verified description of unauthorized acquisition and relevant dates]. The incident occurred or may have occurred between [START DATE] and [END DATE]. We discovered the incident on [DISCOVERY DATE].

What Information Was Involved

Our investigation determined that the affected information relating to you included [list only verified data elements]. [State whether each listed element was encrypted and whether any decryption key was acquired, if verified and useful.]

What We Are Doing

We [describe verified containment, investigation, restoration, security, vendor, and law-enforcement measures]. We are also [describe any credit monitoring, identity protection, or other assistance accurately, including provider, term, activation deadline, exclusions, and enrollment method].

What You Can Do

You may review account statements and credit reports for activity you do not recognize and follow the account provider's reporting instructions. Additional incident-specific steps include:

• [________________________________]
• [________________________________]
• [________________________________]

If offering fraud-alert, credit-freeze, identity-theft, medical-identity, or tax-identity resources, attach a counsel-reviewed resource sheet containing current contact information and instructions appropriate to the affected data.

For More Information

Contact [ORGANIZATION OR RESPONSE CENTER] at [PHONE], [EMAIL OR WEB ADDRESS], during [HOURS AND TIME ZONE]. Reference incident [IDENTIFIER].

Sincerely,

[AUTHORIZED NAME]
[TITLE]
[ORGANIZATION]

Final Release Checklist

• ☐ Every factual statement was checked against the current investigation record.
• ☐ No unsupported assurance states that information was not accessed, acquired, used, or misused.
• ☐ The recipient population and address list were quality-checked.
• ☐ The notice method and send date satisfy the approved legal calendar.
• ☐ Assistance terms, activation deadlines, and vendor instructions are accurate.
• ☐ Texas AG reporting and nationwide CRA reporting were separately completed or documented as not triggered.
• ☐ Other-state, federal, sector, contractual, and insurance overlays were completed.
• ☐ Legal, privacy, security, communications, and executive approvals were recorded.
• ☐ Copies, delivery evidence, OAG confirmation, and the decision record will be retained under the approved retention schedule.

Current Official References

• Texas Legislature, Business and Commerce Code Chapter 521: https://tcss.legis.texas.gov/resources/BC/htm/BC.521.htm
• Texas Office of the Attorney General, Data Breach Reporting: https://www.texasattorneygeneral.gov/consumer-protection/data-breach-reporting

Verified August 29, 2026. Sections 521.002 and 521.053 were checked against the current official Legislature text. The mandatory bill-index screen surfaced enacted 2025 H.B. 150, but the official enrolled bill only cross-references §§ 521.002 and 521.053 and does not amend them; the current § 521.053 history ends with 2023 S.B. 768. No case citations appear in this file.