Texas Cybersecurity and Data Privacy Laws for Businesses: Which Ones Apply to You (2026)

Owners keep hearing about SB 2610, the privacy act, HIPAA, or CMMC, and they can’t tell which ones are theirs. Fair enough. This guide sorts that out. It’s the legal map behind our cybersecurity services in Texas, and its job is to route you to the right rule, then to the deeper guide for it. There’s no single cyber code. It has a stack. Nearly every business carries more than 1 layer. A healthcare billing firm with a state contract and a fingerprint time clock can carry 5 at once.

What Counts as a Texas Cybersecurity Law for a Business?

A Texas cybersecurity law for a business is any state statute, or any federal rule enforced against Texas companies, that tells you how to protect, collect, keep, or report personal or contract data. Texas spreads them across 3 codes, Business and Commerce, Health and Safety, and Government, and federal rules fill in by industry.

They arrived piecemeal. Nobody planned it. The 2025 session alone added the SB 2610 safe harbor, the Texas Responsible Artificial Intelligence Governance Act, the Texas Cyber Command, and 2 data broker amendments, and every one of them was in force by January 1, 2026. That’s why nobody can find the whole list in one place. There’s no regular session in 2026, and the 90th Legislature doesn’t convene until January 12, 2027, so the map below should hold until then.

Here’s what nobody leads with. These laws overlap far more than they conflict. One written security program, built on a named framework and dated, covers the security piece of almost all of them. The differences sit in notices, consent, and who gets to enforce.

Which Texas Data Law Applies to My Business?

Start with what you do, not with the statute names. Find every row in this table that describes your company. The first row catches almost everyone, so expect more than 1 match.

2 rows trip people. The SB 2610 row isn’t a requirement at all, and the privacy act row skips most small companies. We’ll take both apart below.

What Security Duty Does Every Texas Business Already Have?

It’s in Business and Commerce Code Chapter 521, and it’s older and broader than anything passed in 2025. Section 521.052 says a business “shall implement and maintain reasonable procedures” to protect sensitive personal information it collects or keeps in the regular course of business. It names no framework. It sets no size floor. A 3-person bookkeeping office and a 3,000-person distributor owe the same duty. Same words. Same penalties.

Sensitive personal information has a narrow legal meaning. Narrower than people think. It’s a name paired with an unencrypted Social Security number, a driver’s license or government ID number, or a card or account number with the code that opens the financial account. Health details count too, whether they describe a condition, the care someone got, or how it was paid for. Payroll files qualify. So do insurance enrollment forms. So does a scanned license in a customer file.

The same section has a disposal rule. Most offices ignore it. Customer records you don’t need anymore have to be shredded, erased, or made unreadable. An old file server in a closet still holds them. So does a copier hard drive. People forget copiers.

Penalties run from $2,000 to $50,000 per violation. Late breach notice adds up to $100 per person owed notice per day, capped at $250,000 for 1 breach. You get 60 days to tell affected people and 30 days to tell the Attorney General once a breach reaches 250 Texans. We keep the step-by-step version in our data breach response plan for Texas businesses, so we won’t repeat it here.

There’s 1 carve-out that matters. Section 521.052(c) says the security duty doesn’t apply to a financial institution under the Gramm-Leach-Bliley Act, because those firms answer to the FTC Safeguards Rule instead of the general state duty. The notice duty still applies.

What Do 659 Texas Breach Notices Say About Who These Laws Reach?

We pulled every notice the Texas Attorney General’s data breach report published between October 17, 2025 and October 16, 2026. That’s 659 filings from organizations that told the state they’d lost sensitive data on at least some Texans, and because the AG drops most listings after a year, this is the full record for that window rather than a sample. Here’s how they break down.

3 things stand out.

First, 384 of the 659 filers, or 58.3%, listed an address outside Texas. Chapter 521 follows the Texans in your files, not the city on your letterhead. A Colorado software company that loses data on 250 or more Houston customers files here like anyone else. Same clocks, same AG.

Second, 48.7% of notices came from retailers and the catch-all “Other” group. That group reads like a list of ordinary Texas business types, with law firms, general contractors, energy producers, payroll companies, property managers, and a steel products maker all showing up in it. None of them has a sector privacy regulator, so Chapter 521 was the main data law in play for them.

Third, these are mostly small breaches, and Social Security numbers drive them. 82.7% involved Social Security numbers. The median filing affected 1,701 Texans, and 71.5% affected fewer than 5,000. A breach doesn’t need to make the news to put you in this table. That’s the point.

Does Company Size Change Which Texas Laws Apply?

For the privacy act and SB 2610, yes. Most of the rest, no.

The Texas Data Privacy and Security Act doesn’t apply to a business that’s small under the federal Small Business Administration’s size standards, which vary by industry. A small business still can’t sell sensitive data without the consumer’s consent under Section 541.107. The act also only protects people acting “in an individual or household context,” so data about B2B contacts and your own employees falls outside it. A lot of Texas B2B firms are out of scope for 2 separate reasons. Check both.

SB 2610 flips that. Its safe harbor only exists for businesses under 250 employees, and that’s nearly every company in the state. In the Census Bureau’s Statistics of US Businesses for 2022, Texas had 500,456 employer firms. We sorted them by tier.

Census doesn’t publish a break at 249, so the 200 to 249 group sits in a wider bucket and we left it out. Firms that operate in several states are counted in Texas but sized by their national headcount, which fits the law’s focus on the whole business entity.

So 87.0% of Texas employer firms have fewer than 20 people. That’s not a pass. Chapter 521, the biometric law, TRAIGA, and the Texas health privacy chapter have no size threshold at all. SB 2610 excuses nothing. It’s a defense you earn by proving a program existed before the breach, and our SB 2610 compliance guide walks the tiers in detail.

Which Industry Rules Stack on Top in Texas?

Sector rules are where the real work lives. Each one below has its own guide. This is the short version.

Healthcare and anyone who touches health data

HIPAA is the federal floor. Texas adds Health and Safety Code Chapter 181, the law most people still call HB 300, and its definition of a covered entity is much wider than HIPAA’s. It reaches anyone who collects, stores, analyzes, or transmits protected health information for gain or even pro bono, and it names business associates, schools, information or computer management entities, and website operators that handle that data. A billing service or a benefits broker can be covered under Texas law without ever being a HIPAA covered entity. Vendors miss this.

Chapter 181 requires training within 90 days of hire, a signed completion statement kept for 6 years, and retraining within a year of a material change in state or federal privacy law for every affected employee. Penalties run up to $5,000 per violation for negligence, $25,000 for knowing violations, and $250,000 when health data is used for financial gain. Start with our HIPAA IT compliance checklist for Texas, and read how HIPAA and SB 2610 interact if you’re under 250 employees.

Banks, lenders, advisers, and tax preparers

These firms answer to the FTC Safeguards Rule or a banking regulator. Texas steps back. Chapter 521’s security duty doesn’t apply to them, and the privacy act exempts them. Notice still does. The Safeguards Rule asks for a written program, a named Qualified Individual, and an FTC notice within 30 days of discovering an event that involves at least 500 consumers, filed on the FTC’s online form. Budget lines and regulator differences are in our GLBA compliance cost guide for Texas.

Defense suppliers and their subs

CMMC Level 1 self-assessments have been showing up in Defense contracts since November 10, 2025, and they flow down to subcontractors. The Department of War suspended Phase 2 on July 13, 2026, which paused the third-party assessment milestone. Phase 1 didn’t pause, and neither did DFARS 252.204-7012 or NIST SP 800-171 for controlled unclassified information. Our page on CMMC compliance in Texas tracks where that stands.

Energy and utilities

NERC CIP is an electrical test, not an industry label. Owning wells or pipelines doesn’t, by itself, put a company on the NERC registry. Generation assets can. The ones that own generation, transmission, or qualifying inverter-based resources are, and their obligations scale with the impact rating of each asset. Our NERC CIP compliance guide for Texas shows how to run that test.

What Do Texas State Contracts Add?

2 rules. 1 of them moved in 2025.

The first is training. Under Government Code 2063.104, any contractor with access to a state agency computer system or database completes a certified cybersecurity training program during the contract and every renewal, using a program the agency selects. Subs and officers count too. The agency reports completion to the Texas Cyber Command by August 31 each year. Plenty of templates still cite the old Section 2054.5192. The duty is nearly the same. The number changed, and completion now goes to the Cyber Command instead of DIR.

The second is TX-RAMP, the state’s security authorization for cloud services. HB 150 moved it into Section 2063.408, effective September 1, 2025, and put the Cyber Command in charge of its rules. A state agency can’t enter or renew a contract for covered cloud services unless the vendor shows compliance, and a vendor can do that with federal authorization or another state’s approved program. When we checked the current Government Code, Section 2054.0593 no longer appeared in Chapter 2054, though DIR’s own eligibility page and many vendor pages still cite it. The TX-RAMP eligibility page is still the practical starting point.

If you build or service for state, city, or federal owners, our guide to IT compliance for Texas contractors lays out which rule each contract type brings, from private jobs up to Defense work.

Which Texas Laws Catch Businesses by Surprise?

These 3 rarely come up in an IT conversation. They should.

Fingerprint and face scanners

Texas has had a biometric privacy law on the books for more than 15 years, and most owners have never heard of it. Business and Commerce Code 503.001 covers retina and iris scans, fingerprints, voiceprints, and hand or face geometry captured for a commercial purpose. You have to tell the person and get consent before capture. You can’t sell, lease, or share it outside a few narrow exceptions. You have to protect it at least as well as your other confidential information, and destroy it within a reasonable time, no later than a year after the purpose ends.

Take the fingerprint time clock. Its purpose usually ends when someone leaves, and the law presumes an employer’s security purpose ends at termination. So former employees’ prints have a clock running. Check yours. Penalties reach $25,000 per violation. And the AG uses it. Meta agreed to pay Texas $1.4 billion over 5 years in 2024 to settle a case under it. Yes, billion.

AI tools that reach Texans

TRAIGA took effect January 1, 2026. It has no size threshold. Under the enrolled text of HB 149, it applies to anyone who does business in Texas, makes a product Texans use, or develops or deploys an AI system here, whatever its size. The Attorney General enforces it, with a 60-day cure window and penalties from $10,000 for a curable violation up to $200,000 for one that can’t be cured. Our TRAIGA guide for small businesses covers all 6 prohibited practices, including the 4 that apply to private businesses.

Buying or reselling data you didn’t collect

The data broker law used to catch only firms that made most of their money from other people’s data. SB 2121 widened that on September 1, 2025. It now applies to a business that, in any 12 months, either earns more than half its revenue from personal data it didn’t collect directly or earns revenue from processing or transferring that kind of data on more than 50,000 people. Lead generation shops and list resellers should check that second test. So should agencies. Covered brokers register with the Secretary of State for $300 a year and keep a written security program.

How Do I Work Out Which Texas Laws Apply to Us?

It takes an afternoon, not a law degree. Here’s the order we use in a compliance assessment.

1. List every type of personal data you keep, including Social Security numbers, license numbers, card data, health details, biometrics, and any contract data from a government customer, such as Defense drawings or state system access.
2. Count your employees across the whole company, not just 1 office. SB 2610 ties its tiers to the employees of the business entity, and it doesn’t limit that count to a single location.
3. List who pays you. Consumers, patients, state agencies, Defense primes, and utilities each bring their own rule.
4. Check your tools for fingerprint or face readers, AI features, and any purchased contact lists.
5. Pick the one framework your strictest layer requires, such as HIPAA, NIST SP 800-171, or CIS Controls IG1, and build to it.
6. Write the program down, date it, and review it every year. SB 2610’s defense depends on proving the program existed when the breach happened.

Step 5 does most of the work. A company with HIPAA data and a Defense subcontract doesn’t need 2 programs. It needs 1 good one, mapped twice.

What Does Getting It Wrong Cost in Texas?

State penalties are real. They aren’t usually the biggest number. Downtime, lost contracts, and the lawsuits that follow a breach tend to outrun them, which is part of why we tie compliance work to the real cost of IT downtime in Texas. On the prevention side, here’s what managed cybersecurity costs in Texas.

Every row says Attorney General. That’s the honest summary of Texas enforcement. 1 office, many statutes, and no private lawsuits under the privacy act, TRAIGA, or SB 2610. Breach victims can still sue under ordinary law, though, and that’s the exposure SB 2610 was written to shrink.

Questions Texas Owners Ask About Cyber and Privacy Law

Does Texas have a cybersecurity law for private businesses?

Are small businesses exempt from Texas data laws?

Do Texas data laws apply if my company is based in another state?

Can we keep using a fingerprint time clock?

Do small Texas businesses have to build a cybersecurity program?

Which framework covers the most Texas laws at once?

Not sure which rows are yours? Our compliance and regulatory assessment maps your data, contracts, and tools against every law on this page, then hands you 1 program that covers them.

This guide explains how these laws generally apply to businesses. It isn’t legal advice, and your attorney should confirm how any statute applies to your company.

Comparing providers for that work? Read our MSP contract guide for Texas before you sign, see how we rank the best managed IT services in Texas, or talk to our team.