Third-Party Risk Management SOP - Texas

THIRD-PARTY RISK MANAGEMENT SOP — TEXAS SUPPLEMENT

Organization: [________________________________]
SOP Number: TPRM-TX-[____]
Version: [____]
Effective Date: [__/__/____]
Approved By: [________________________________]

TABLE OF CONTENTS

1. Purpose and Scope
2. Texas Regulatory Framework
3. Definitions
4. Risk Tiering — Texas Enhancements
5. Third-Party Lifecycle — Texas Requirements
6. Roles and Responsibilities
7. Documentation and Systems of Record
8. Metrics, KRIs, and Reporting
9. Exceptions and Compensating Controls
10. Review Cadence
11. Annexes

1. PURPOSE AND SCOPE

1.1 Purpose

This SOP supplements the Universal TPRM SOP with Texas-specific requirements under the Texas Data Privacy and Security Act (TDPSA) (Tex. Bus. & Com. Code Ch. 541, effective July 1, 2024), the Texas Identity Theft Enforcement and Protection Act (Tex. Bus. & Com. Code § 521.053), and the Capture or Use of Biometric Identifier Act (CUBI) (Tex. Bus. & Com. Code § 503.001).

1.2 Scope

Applies to all third-party relationships involving:
☐ Personal data of Texas consumers (as defined under TDPSA § 541.001)
☐ Sensitive data of Texas consumers (§ 541.001(29))
☐ Biometric identifiers of Texas residents (CUBI § 503.001)
☐ Sensitive personal information triggering TX breach notification (§ 521.053)
☐ Services delivered to Texas-based operations or customers

2. TEXAS REGULATORY FRAMEWORK

3. DEFINITIONS

4. RISK TIERING — TEXAS ENHANCEMENTS

Vendors processing CUBI-regulated biometric data shall be classified no lower than High tier. Vendors processing TDPSA sensitive data shall be classified no lower than Medium tier.

5. THIRD-PARTY LIFECYCLE — TEXAS REQUIREMENTS

5.1 Due Diligence Enhancements

5.2 Contract Requirements — Texas Additions

5.3 Ongoing Monitoring — Texas Additions

5.4 Offboarding — Texas Additions

☐ Confirm controller-directed deletion or return after service completion under § 541.104(b)(6)(B), subject to required legal retention
☐ For covered CUBI data: confirm destruction under § 503.001(c)(3) or the applicable subsection (c-1) longer-record rule
☐ Obtain written destruction certification
☐ Verify subprocessors have deleted TX data

6. ROLES AND RESPONSIBILITIES

7. DOCUMENTATION

Additional TPRM platform fields:
☐ TDPSA applicability determination
☐ Processor agreement status
☐ CUBI applicability (biometric data flag)
☐ Sensitive data consent verification
☐ Universal opt-out compliance status
☐ TX breach notification SLA tracking

8. METRICS

9. EXCEPTIONS

☐ TDPSA/CUBI exceptions require approval by [CCO / General Counsel]
☐ Document compensating controls with statutory reference
☐ Maximum exception duration: [____] days

10. REVIEW CADENCE

11. ANNEXES

Annex A: TDPSA Processor Agreement Checklist

☐ Processing follows controller instructions (§ 541.104(a))
☐ Security and breach-notice assistance (§ 541.104(a)(2))
☐ Confidentiality obligations (§ 541.104(b)(6)(A))
☐ Data deletion/return after service completion, subject to legal retention (§ 541.104(b)(6)(B))
☐ Assessment cooperation (§ 541.104(b)(6)(D))
☐ Subprocessor written contract imposes the processor's personal-data duties (§ 541.104(b)(6)(E)); obtain controller approval if the parties separately agree to require it
☐ Consumer rights support (access, correction, deletion, portability, opt-outs)
☐ Notification if unable to meet obligations

Annex B: CUBI Compliance Checklist

☐ Commercial capture and any § 503.001(e) exception assessed, including the AI-model and security-use exceptions added effective January 1, 2026; if subsection (b) applies, notice and consent obtained before capture
☐ Public availability alone is not treated as consent unless § 503.001(b-1)'s condition is met
☐ Purpose and duration of collection explained as an internal transparency practice, beyond subsection (b)'s express notice-and-consent terms
☐ Sale, lease or disclosure checked against the specific permissions in § 503.001(c)(1)
☐ Stored with reasonable care, at least same standard as other confidential information (§ 503.001(c)(2))
☐ Destruction scheduled under § 503.001(c)(3) or the applicable subsection (c-1) longer-record rule; review subsection (f) if AI-training data is later put to a different commercial use
☐ Written retention/destruction schedule maintained
☐ Vendor CUBI compliance verified and documented
☐ Consent forms retained for audit purposes

Annex C: Texas Breach Notification Contract Clause Requirements

For all vendor contracts involving TX resident sensitive personal information:

☐ Vendor must notify organization within [____] hours of discovering breach
☐ Notification SLA must allow compliance with 60-day consumer notification deadline (§ 521.053)
☐ Vendor must cooperate with breach investigation
☐ Vendor must support identification of affected TX residents
☐ Vendor must support electronic AG notification when at least 250 Texas residents are involved (S.B. 768, 2023)
☐ Vendor must preserve evidence and provide forensic cooperation
☐ Vendor must support consumer notification content requirements

Annex D: TDPSA Processor Due Diligence Questionnaire Supplement

SOURCES AND REFERENCES

• Texas Data Privacy and Security Act (TDPSA), Tex. Bus. & Com. Code Ch. 541 (eff. July 1, 2024)
• Tex. Bus. & Com. Code § 521.053 (Breach Notification; 60-Day Deadline)
• Tex. Bus. & Com. Code § 503.001 (CUBI)
• HB 4 (88th Legislature, 2023) — Enacted the Texas Data Privacy and Security Act
• OCC Bulletin 2023-17 (risk-based supervisory guidance for banking organizations supervised by the Board, FDIC, or OCC; not law)
• DOJ Evaluation of Corporate Compliance Programs (Updated September 2024)

This template is provided for informational purposes only and does not constitute legal advice. Consult qualified legal counsel before use.