Texas Data Breach Law for Businesses: 60 Day Notice, AG Report at 250
Yes, under Texas law, most businesses that own or license computerized sensitive personal information must notify affected individuals no later than 60 days after determining a breach occurred. If the incident affects 250 or more Texas residents, the business must also file the Attorney General’s Data Breach Report within 30 days. The clock starts the moment you confirm unauthorized access, not when the attack began.
TL;DR:
- Texas law generally triggers notice when someone acquires computerized sensitive personal information; mere viewing without copying may not qualify, depending on the facts.
- For incidents affecting 10,000 or more people, notify nationwide consumer reporting agencies; alternative notice applies if costs exceed $250,000 or more than 500,000 are affected.
- The Attorney General may seek $2,000 to $50,000 per violation, plus daily penalties up to $100 per person; total penalties cap at $250,000 per breach.
- Preserve logs and forensic images before remediation, then establish which residents and data were affected; accurate reporting depends on evidence collected early.
- HIPAA entities must meet Texas and federal duties; some financial institutions must report FTC events involving at least 500 consumers’ unencrypted records within 30 days.
Table of Contents
Table of Contents
- Who the statute covers and what counts as a breach
- Deadlines, thresholds, and how notice must be delivered
- What enforcement looks like and what it can cost you
- How Texas law overlaps with HIPAA and federal rules
- A step-by-step checklist for the days after discovery
- What containment partners typically bring to the table
- What this law actually demands versus what businesses assume
- How we help Texas businesses prepare for and respond to breaches
- FAQ
- Sources
Who the statute covers and what counts as a breach
Texas Business and Commerce Code §521.053 defines a “breach of system security” as the unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of sensitive personal information. That definition matters because it is triggered by acquisition, not just access. Someone merely viewing a file without copying or exporting it may fall outside the statute, depending on the facts.
“Sensitive personal information” generally covers a person’s first name or initial and last name combined with a Social Security number, driver’s license or government ID number, or financial account number paired with a security code that would permit access. Health information and certain biometric data also qualify under related provisions.
The law reaches any person or business that conducts business in Texas and owns or licenses computerized data containing this kind of information, regardless of where that business is headquartered. A few narrow carve-outs exist:
- Good-faith acquisition by an employee or agent for a legitimate business purpose is not a breach, as long as the information is not used or disclosed improperly.
- Encrypted data generally falls outside notification duties unless the encryption key was also compromised.
- Entities already governed by HIPAA for the same incident may satisfy parallel obligations rather than duplicating every state-level step, though Texas notice duties still apply.
Deadlines, thresholds, and how notice must be delivered
Once you determine a breach occurred, the timeline is fixed and unforgiving:
- Notify affected Texas residents without unreasonable delay and no later than the 60th day after you determine the breach happened, under §521.053.
- A short delay beyond that window is permitted only if law enforcement requests it to avoid compromising an investigation, or if you genuinely need more time to determine the scope of affected individuals and restore system integrity.
- If the breach affects 250 or more Texas residents, submit the Attorney General’s Data Breach Report no later than the 30th day after determining the breach occurred, using the AG’s online webform.
- Acceptable notice methods include written mail, electronic notice if it complies with federal E-SIGN requirements, and, for qualifying circumstances, website posting or statewide media notice.
- If the cost of notice would exceed $250,000, or more than 500,000 people are affected, alternative notice methods apply, and breaches affecting 10,000 or more persons require notifying nationwide consumer reporting agencies as well.
The Attorney General’s office expects the Data Breach Report to reflect the number of Texans notified as of filing. Many businesses submit an initial report and update it as the notification campaign continues, so keep records of every notice sent and every revision made to the filing.
What enforcement looks like and what it can cost you
Texas does not treat notification failures as a paperwork lapse. Texas Business and Commerce Code §521.151 gives the Attorney General authority to pursue civil penalties directly tied to how the breach was handled.
The penalty structure ranges from $2,000 to $50,000 per violation, with an aggregate cap of $250,000 for all affected individuals after a single breach.
- Daily per-person penalties of up to $100 apply when a business fails to take reasonable action to notify after a breach, and these accrue separately from the base per-violation penalty.
- The Attorney General can also seek injunctive relief, forcing a business to adopt specific remediation or notification practices under court order.
- There is no private right of action under this chapter, but enforcement exposure and related civil litigation (negligence, breach of contract) often follow the same facts the AG investigates.
A documented cybersecurity program, one that maps to a recognized framework such as NIST, will not erase a notification failure, but it does give counsel something concrete to point to when demonstrating reasonable diligence. Texas Business and Commerce Code §542 references this kind of alignment as a mitigation factor worth building into your security posture before an incident, not after one.
How Texas law overlaps with HIPAA and federal rules
Texas breach notification duties rarely exist in isolation. Depending on your industry, you may be answering to two or three regulators for the same incident.
- Healthcare providers and other HIPAA-covered entities must satisfy both HIPAA’s breach rules and Texas’s statutory duties; when the two conflict, the Texas Attorney General’s guidance on HIPAA interaction directs covered entities to follow the stricter requirement.
- Certain financial institutions fall under the FTC Safeguards Rule, which as of its 2024 amendments requires reporting notification events involving 500 or more consumers’ unencrypted information to the FTC within 30 days of discovery. That creates a dual-reporting obligation running parallel to your state duty.
- The Texas Data Privacy and Security Act and the Texas Data Broker Act layer additional, proactive obligations on top of breach response, including data protection assessments, disclosure requirements, and broker registration for businesses that trade in personal data.
If your business touches health records, financial accounts, or data brokering in any form, map out which regime governs each data type before an incident forces the question.
A step-by-step checklist for the days after discovery
The first 72 hours shape everything that follows, including how the Attorney General and any plaintiffs’ attorney will view your response later.
- Contain the incident immediately: isolate affected systems, change credentials, and stop ongoing data loss before anything else.
- Preserve logs, forensic images, and system snapshots before remediation overwrites the evidence you will need for the AG report and any later inquiry.
- Engage your IT or cybersecurity team, or an outside incident response partner, to determine scope: what data was accessed, how many Texas residents are affected, and whether encryption keys were compromised.
- Decide whether a brief delay is warranted for law enforcement coordination or scope determination, and document that decision and its basis.
- If 250 or more Texas residents are affected, prepare and submit the AG Data Breach Report within the 30-day window.
- Draft and send consumer notices within the 60-day statutory ceiling, leveraging tools like customizable stamp and reward cards to enhance customer engagement, and prepare consumer reporting agency notice if 10,000 or more people are affected.
- Document every decision, timeline, and mitigation step as you go, and loop in legal counsel early rather than after notices go out.
Pro Tip: Treat your incident timeline as a living document from hour one; regulators and counsel care less about a perfect response and more about a well-documented one.
Our incident response guidance walks through the artifacts worth preserving in more detail, including log exports and remediation records that hold up under later scrutiny.
What containment partners typically bring to the table
Speed and documentation win these situations, and that is exactly where a managed response partner earns its keep. A retainer-based incident response relationship means containment starts in hours, not days, because the access, tooling, and escalation path already exist before the breach happens.
- Preserved host and network logs, an incident timeline, and a forensic summary are the baseline artifacts counsel and the Attorney General’s office expect to see.
- Aligning your written security policies to a recognized framework such as NIST gives you a defensible record of reasonable practices, which matters both for operational recovery and for how enforcement discretion gets applied.
- A managed partner can help draft the AG Data Breach Report fields and the consumer notice templates in parallel, rather than sequentially, which shortens your path to the 30-day and 60-day deadlines.
The businesses that fare best after a breach are rarely the ones with the fewest incidents. They are the ones that can produce a clean, dated record of exactly what they did and when.
What this law actually demands versus what businesses assume
Most of the anxiety around Texas breach law comes from the penalty headlines, not the compliance mechanics. The $50,000-per-violation figure gets attention, but the businesses that end up facing enforcement are almost always the ones that stayed silent past the 60-day mark, not the ones that notified late by a few days with a documented reason.
The conventional advice tends to over-index on the legal filing and under-index on the technical groundwork that makes a clean filing possible. You cannot accurately report “number of Texans affected” on the AG form if you never built the logging and monitoring that tells you who was affected in the first place. That is an IT problem wearing a legal hat.
If you run a business in Texas, the priority order should be: know what sensitive data you hold and where, build the logging that lets you answer “who was affected” within days instead of weeks, and only then worry about the notice templates. A documented cybersecurity program is not a legal nicety. It is the thing that makes every deadline in this statute actually achievable.
— Randy Bryan
How we help Texas businesses prepare for and respond to breaches
We build incident response readiness into the way we support Texas businesses, because the 60-day and 30-day clocks in this statute leave no room for scrambling. We help with containment, evidence preservation, and the technical groundwork that supports accurate AG Data Breach Reporting.
- Our incident response service focuses on fast containment, forensic log preservation, and documentation suited to AG reporting and counsel review.
- Our HIPAA compliance and FTC Safeguards Rule work helps healthcare and financial clients reconcile overlapping state and federal duties before an incident forces the issue.
- Our cybersecurity services and risk assessments build the documented security program that regulators and courts treat as evidence of reasonable care.
If you want a readiness review before an incident happens, or a retainer in place so response starts the moment you need it, reach out through our managed IT services page to start the conversation.
This article is general information, not a substitute for advice from a qualified lawyer. Consult a qualified legal professional about your own circumstances before acting on anything here.
FAQ
What triggers the duty to notify under Texas data breach law?
Notification is required when a business determines that an unauthorized person acquired computerized sensitive personal information, such as a name paired with a Social Security number or financial account number. The duty applies to any business that conducts operations in Texas and owns or licenses that data, per §521.053.
How long do Texas businesses have to notify affected individuals?
Businesses must notify affected individuals without unreasonable delay and no later than 60 days after determining a breach occurred, with limited extensions allowed for law enforcement requests or scope determination. This deadline comes directly from Texas Business and Commerce Code §521.053.
When must a business report a breach to the Texas Attorney General?
If 250 or more Texas residents are affected, the business must file the AG Data Breach Report within 30 days of determining the breach occurred. Breaches affecting fewer than 250 Texas residents do not trigger this specific reporting duty, though individual notice obligations still apply.
What penalties can a Texas business face for failing to notify?
Civil penalties range from $2,000 to $50,000 per violation, with daily per-person penalties up to $100 for failing to take reasonable action, and an aggregate cap of $250,000 for all individuals after a single breach. These penalties come from Texas Business and Commerce Code §521.151 and are enforced by the Attorney General’s office.
Does HIPAA replace Texas breach notification requirements for healthcare businesses?
No, HIPAA-covered entities must satisfy both federal HIPAA breach rules and Texas state notification duties for the same incident. Where the two sets of rules differ, entities generally need to follow the stricter requirement, as outlined in Texas Attorney General guidance.
Sources
- Texas Business and Commerce Code §521.053
- Data Breach Reporting | Office of the Attorney General
- FTC blog: Safeguards Rule notification requirement now in effect
Recommended
Table of Contents
