Texas TDPSA Privacy Notice

TEXAS DATA PRIVACY AND SECURITY ACT PRIVACY NOTICE

Effective date: [__/__/____]

Last updated: [__/__/____]

Important Use Gate

This template is a Texas consumer-notice and compliance-control packet. It is not a determination that the Texas Data Privacy and Security Act (TDPSA) applies.

Before publication, counsel must classify the organization and each processing activity under current Tex. Bus. & Com. Code Chapter 541. Do not describe an activity as exempt merely because some data is regulated by another law; document whether an entity-level, data-level, role-specific, or use-specific provision applies.

The TDPSA generally took effect July 1, 2024. The technology-based authorized-agent provision in § 541.055(e) took effect January 1, 2025. The processor security-assistance amendment concerning applicable data handled by an artificial intelligence system took effect January 1, 2026.

1. Publisher and Notice Scope

Controller legal name: [________________________________]

Trade names covered: [________________________________]

Covered websites, applications, products, services, and offline interactions: [________________________________]

Controller address: [________________________________]

Privacy email: [________________________________]

Rights-request page: [________________________________]

Appeal method: [________________________________]

Texas Attorney General complaint mechanism to provide after a denied appeal: [________________________________]

This Notice describes how [CONTROLLER NAME] ("we," "us," or "our") processes personal data relating to Texas consumers through the covered services identified above.

A "consumer" under Tex. Bus. & Com. Code § 541.001(7) is a Texas resident acting only in an individual or household context. The definition excludes an individual acting in a commercial or employment context.

2. Coverage and Exemption Record

Section 541.002 applies Chapter 541 only when all three applicability elements are satisfied. Section 541.107 separately imposes a prior-consent rule on a covered small business that sells sensitive personal data.

Do not publish an exemption conclusion in this Notice unless consumers need it and counsel has approved the wording.

3. Categories of Personal Data We Process

Personal data means information, including sensitive data, linked or reasonably linkable to an identified or identifiable individual. It does not include deidentified data or publicly available information as those terms are defined in § 541.001.

For this Notice, sensitive data includes the categories stated in § 541.001(29): specified protected-characteristic and health data, genetic or biometric data processed to uniquely identify an individual, personal data collected from a known child, and precise geolocation data.

4. Purposes for Processing

We process the categories identified above for the following disclosed purposes:

• [Provide, operate, maintain, and improve specified products or services.]
• [Create and administer accounts and transactions.]
• [Communicate about support, service, security, and requested information.]
• [Authenticate users and detect fraud, abuse, and security incidents.]
• [Conduct analytics, research, advertising, or campaign measurement.]
• [Comply with law and protect rights, safety, and systems.]
• [Evaluate or complete a corporate transaction.]
• [Other purpose stated with enough detail for the affected consumer.]

Section 541.101 limits collection to what is adequate, relevant, and reasonably necessary for disclosed purposes. We obtain consent before processing for a purpose that is neither reasonably necessary to nor compatible with the disclosed purpose unless Chapter 541 otherwise permits the processing.

5. How We Share Personal Data

Section 541.102 requires the applicable categories of personal data shared with third parties and the applicable categories of third parties. Confirm that this table covers both.

6. Sale, Targeted Advertising, Profiling, and Sensitive Data

Sale of Personal Data

☐ We do not sell personal data as defined by § 541.001(28).

☐ We sell these categories of personal data: [________________________________].

Categories of third-party purchasers or recipients: [________________________________]

Sale opt-out method: [________________________________]

Targeted Advertising

☐ We do not process personal data for targeted advertising as defined by § 541.001(31).

☐ We process these categories for targeted advertising: [________________________________].

Targeted-advertising opt-out method: [________________________________]

Profiling

☐ We do not use solely automated profiling in furtherance of a decision producing a legal or similarly significant effect concerning a consumer.

☐ We conduct the following covered profiling: [________________________________].

Profiling opt-out method: [________________________________]

Sensitive Data and Required Sale Notices

We obtain consent before processing sensitive data when § 541.101(b)(4) applies. We process sensitive data of a known child in accordance with that subsection's Children's Online Privacy Protection Act requirement.

☐ We do not sell sensitive personal data.

☐ We sell sensitive personal data and post the following notice in the same location and manner as this Notice:

NOTICE: We may sell your sensitive personal data.

☐ We do not sell biometric personal data.

☐ We sell biometric personal data and post the following notice in the same location and manner as this Notice:

NOTICE: We may sell your biometric personal data.

If we sell personal data or process it for targeted advertising, § 541.103 requires a clear and conspicuous disclosure of the activity and the opt-out method.

7. Texas Consumer Rights

Subject to authentication and applicable statutory provisions, a Texas consumer may request to:

• confirm whether we process the consumer's personal data and access that data;
• correct inaccuracies, considering the data's nature and processing purposes;
• delete personal data provided by or obtained about the consumer;
• when available digitally, obtain a portable and readily usable copy of personal data the consumer previously provided to us; and
• opt out of targeted advertising, sale of personal data, or profiling in furtherance of a decision producing a legal or similarly significant effect.

A parent or legal guardian may exercise § 541.051 rights regarding personal data belonging to a known child.

We do not discriminate against a consumer for exercising a Chapter 541 right, subject to the qualifications in § 541.101(c).

8. Submitting and Authenticating Requests

Request methods:

• Web form: [________________________________]
• Email: [________________________________]
• Telephone: [________________________________]
• Postal address: [________________________________]
• Other secure method: [________________________________]

Section 541.055 generally requires at least two secure and reliable request methods. A controller operating exclusively online with a direct relationship to the consumer from whom it collects personal information may qualify for the email-only rule in § 541.055(d).

We do not require a consumer to create a new account to exercise a right. We may require use of an existing account and may request information reasonably necessary to authenticate a consumer and the request.

Authorized Agents and Technology-Based Opt-Out Requests

A consumer may designate an authorized agent to opt out of sale or targeted advertising. The designation may use qualifying technology described by § 541.055(e)-(f).

Technology or signal evaluated: [________________________________]

Clear, affirmative, freely given, and unambiguous choice confirmed: ☐ Yes ☐ No

Texas residency, consumer identity, and agent authority verification: [________________________________]

Technical capability and comparable-request handling: [________________________________]

Do not state that every browser signal is automatically honored. Document the statutory verification requirements and exceptions, then describe the controller's actual implementation accurately.

9. Response Timing, Fees, and Appeals

We respond without undue delay and no later than 45 days after receiving a request. When reasonably necessary because of complexity or request volume, we may extend once for an additional 45 days if we notify the consumer within the initial period and explain the reason.

We provide request information free at least twice annually per consumer. If a request is manifestly unfounded, excessive, or repetitive, we may charge a reasonable administrative fee or decline to act, and we bear the burden specified in § 541.052(d).

If we decline a request, we provide the justification and appeal instructions without undue delay and no later than 45 days after receipt.

Appeal method: [________________________________]

Our appeal process is conspicuously available and similar to the request process. We respond in writing no later than 60 days after receiving an appeal and explain the decision. If we deny the appeal, we provide the Texas Attorney General's current online complaint mechanism.

10. Security, Minimization, and Deidentified Data

We maintain reasonable administrative, technical, and physical data-security practices appropriate to the volume and nature of the personal data. No security measure guarantees absolute security.

We limit collection as described in Section 4. For deidentified data, complete the § 541.106 control record before making any public commitment:

11. Retention and Processing Locations

We retain each category of personal data for [STATE PERIOD OR CRITERIA], considering the disclosed purpose and applicable legal, accounting, security, fraud-prevention, and dispute needs.

Personal data may be processed in [COUNTRIES OR REGIONS] by [CONTROLLER / PROCESSOR CATEGORIES]. Describe any applicable transfer safeguards here: [________________________________].

12. Changes and Contact Information

The "Last updated" date identifies this Notice's current version. We will provide additional notice or obtain consent before a changed or incompatible processing purpose when Chapter 541 or another applicable law requires it.

Questions, requests, or complaints may be directed to:

[CONTROLLER LEGAL NAME]

Attn: [PRIVACY TEAM OR OFFICER]

[ADDRESS]

[EMAIL]

[PHONE]

13. Internal Controller Compliance Record

Required-Notice Cross-Check

Processor Contract and Assistance Check

Section 541.104 governs processor duties and controller-processor contracts. As amended effective January 1, 2026, processor security assistance includes applicable personal data collected, stored, and processed by an artificial intelligence system.

Data Protection Assessment Check

Section 541.105 requires a documented assessment for each listed activity. Complete a separate assessment; this Notice does not satisfy that duty.

Enforcement Awareness

The Texas Attorney General has exclusive authority to enforce Chapter 541. Section 541.154 provides a 30-day notice-and-cure process before an enforcement action. Section 541.155 authorizes a civil penalty not exceeding $7,500 per violation after the cure period or for breach of a cure statement. Section 541.156 creates no private right of action.

Do not present the cure process as permission to delay compliance.

14. Approval and Version Control

Sources and References

• Current Texas Business & Commerce Code Chapter 541
• H.B. 4 enrolled text establishing the TDPSA
• H.B. 149 enrolled text containing the 2026 processor amendment
• Texas Attorney General TDPSA information and complaint link

Conform every statement to the controller's actual data inventory, technology, contracts, request operations, and current law before publication.