1. Home
  2. State breach laws
  3. Texas

Texas data breach notification law

What Texas requires when personal information is exposed: how fast residents must be notified, when the Attorney General has to be told, what it costs to get it wrong, and whether affected people can sue. Governed by Tex. Bus. & Com. Code § 521.053.

60 days
Notification deadline
Required
AG notification
No
Private right of action
Limits punitive damages
Liability protection

What this means if you sell security services

Texas puts breaches on the public record early: once 250 or more Texans are affected, the Attorney General must be told within 30 days of determining the breach occurred, a full month before the 60-day deadline to notify individuals, and the AG publishes the list. Since September 2025, a Texas business with fewer than 250 employees that maintained a qualifying cybersecurity program also can't be ordered to pay punitive damages in a breach lawsuit. That doesn't make it immune, and it doesn't change the duty to notify, but it gives a smaller prospect a concrete, Texas-specific reason to document a real security program after it has been through a breach once.

See recent Texas breach filings →

Requirements in detail

Statute
Tex. Bus. & Com. Code § 521.053
Deadline to notify residents
Without unreasonable delay, and no later than 60 days after determining that the breach occurred.
Attorney General notification
Yes, within 30 days after determining that the breach occurred, if 250 or more Texas residents are affected. Reports go through the Attorney General's online form, and the AG posts a public list of notices. Consumer reporting agencies must also be notified when more than 10,000 people are notified at once.
Penalties
Civil penalties of $2,000 to $50,000 per violation. Failing to notify can add up to $100 per affected person per day, capped at $250,000 per breach. The Attorney General can also seek an injunction and recover attorney's fees.
Private right of action
No. The breach notification law itself doesn't give individuals a right to sue; the Attorney General enforces it. People can still bring other claims after a breach, such as negligence.
Encryption exemption
Texas's notification requirements apply to unencrypted personal information. Encrypted data generally doesn't trigger notice unless the encryption key or credentials were also compromised.
Liability protection for security programs
Since September 1, 2025, a business with fewer than 250 employees that maintained a qualifying cybersecurity program can't be ordered to pay exemplary (punitive) damages in a lawsuit over a breach. Requirements scale with size: basic measures under 20 employees, CIS Controls IG1 for 20–99, and a full framework such as NIST, ISO 27000, CIS, HITRUST, or SOC 2 for 100–249. Actual damages are not limited. These protections limit lawsuits; they don't change the duty to notify. Tex. Bus. & Com. Code ch. 542 (SB 2610, 2025)
Recent changes
SB 2610 (effective September 1, 2025) bars punitive damages in breach lawsuits against businesses with fewer than 250 employees that maintained a qualifying cybersecurity program; it doesn't change notification duties. SB 768 (effective September 1, 2023) shortened the Attorney General deadline from 60 to 30 days.

Texas breach notification FAQ

What is the data breach notification deadline in Texas?

Without unreasonable delay, and no later than 60 days after determining that the breach occurred. The governing law is Tex. Bus. & Com. Code § 521.053.

Does Texas require notifying the Attorney General of a data breach?

Yes, within 30 days after determining that the breach occurred, if 250 or more Texas residents are affected. Reports go through the Attorney General's online form, and the AG posts a public list of notices. Consumer reporting agencies must also be notified when more than 10,000 people are notified at once.

What are the penalties for failing to report a data breach in Texas?

Civil penalties of $2,000 to $50,000 per violation. Failing to notify can add up to $100 per affected person per day, capped at $250,000 per breach. The Attorney General can also seek an injunction and recover attorney's fees.

Can individuals sue over a data breach in Texas?

No. The breach notification law itself doesn't give individuals a right to sue; the Attorney General enforces it. People can still bring other claims after a breach, such as negligence.

Does encrypted data need to be reported in Texas?

Texas's notification requirements apply to unencrypted personal information. Encrypted data generally doesn't trigger notice unless the encryption key or credentials were also compromised.

Does Texas limit breach lawsuits for companies with a cybersecurity program?

Since September 1, 2025, a business with fewer than 250 employees that maintained a qualifying cybersecurity program can't be ordered to pay exemplary (punitive) damages in a lawsuit over a breach. Requirements scale with size: basic measures under 20 employees, CIS Controls IG1 for 20–99, and a full framework such as NIST, ISO 27000, CIS, HITRUST, or SOC 2 for 100–249. Actual damages are not limited. These protections limit lawsuits; they don't change the duty to notify.

Last reviewed October 5, 2026. This summary is for general information and is not legal advice. Statutes change; confirm current requirements with counsel or the Texas Attorney General before relying on them.

Other states with a 60-day deadline

Breach notification laws by state

Compare all 51 jurisdictions on the interactive map →·US data breach statistics →