Law note · Texas
Texas Data Privacy and Security Act (HB 4), general applicability and scope
TDPSA governs private-sector processing of Texas residents' personal data. It applies to a person who conducts business in Texas, or produces a product or service consumed by Texas residents, and who processes or sells personal data, unless the person is a small business under SBA size standards (a limited exception for selling sensitive data under sec. 541.107 applies regardless of size).
The Act excludes state agencies, political subdivisions, GLBA-regulated financial institutions, HIPAA covered entities, nonprofits, higher-education institutions, and electric utilities, and 'personal data' excludes deidentified data and publicly available information.
What it asks of an app
- Determine whether you conduct business in Texas or serve Texas residents, process or sell personal data, and are not a small business under SBA size standards before relying on any TDPSA exemption.
- Treat information a Texas consumer restricted to a specific audience as covered personal data, not as exempt publicly available information.
- Confirm whether a sector exemption applies. TDPSA excludes state agencies, GLBA-regulated financial institutions, HIPAA covered entities, nonprofits, higher-education institutions, and electric utilities.
When LexLint raises it
Declared activities: automated_outreach, crawls_web, deploys_chatbot, processes_biometrics, processes_voice, trains_models
Primary source: official Texas statute text, Business and Commerce Code chapter 541, Texas Constitution and Statutes System