Law note · Texas
Texas Data Privacy and Security Act (TDPSA), no fixed applicability threshold
What it asks of an app
- TDPSA applies to you if you do business in Texas or produce a product or service consumed by Texas residents and you process or sell personal data, unless you qualify as a small business under U.S. Small Business Administration size standards, which vary by industry rather than a fixed revenue or consumer-count number.
- Personal data excludes deidentified data and publicly available information, meaning information lawfully available through government records or that you have a reasonable basis to believe is lawfully available to the public through widely distributed media, the consumer, or someone the consumer disclosed it to.
- Even if you qualify as a small business, you may not sell sensitive personal data without the consumer's prior consent.
When LexLint raises it
crawls_webtrains_models
What we found
TDPSA applies to any person conducting business in Texas, or producing a product or service consumed by Texas residents, that processes or sells personal data and is not a small business as defined by the United States Small Business Administration, except that the sensitive-data-sale consent duty in section 541.107 applies even to a small business.
This is deliberately not a fixed dollar-revenue or consumer-count threshold; the SBA's small-business size standards vary by industry, often revenue in the tens of millions or employee counts in the hundreds, so TDPSA reaches many mid-sized data collectors that fall below other states' 100,000-consumer or $25-million thresholds.
Personal data excludes deidentified data and publicly available information, defined as information lawfully available through government records or that a business has a reasonable basis to believe is lawfully available to the public through widely distributed media, by the consumer, or by a person the consumer disclosed it to. Enforcement is by the Attorney General only, with a 30-day cure period; TDPSA carries no private right of action.