Texas Data Privacy and Security Act: 2026 Business Guide

Texas's new data privacy law takes full effect in 2026. Consumer rights, compliance requirements, and penalties for non-compliance.

The Texas Data Privacy and Security Act: What Changed

The Texas Data Privacy and Security Act (TDPSA), signed into law in June 2023 and now in full enforcement in 2026, gives Texas consumers new rights over their personal data — and creates new obligations for businesses that collect it. If you operate in San Antonio or anywhere in Texas and handle consumer data, this law applies to you.

Unlike the GDPR or California's CCPA, the TDPSA was designed to be business-friendly with clear thresholds. But the penalties for non-compliance are steep: up to $7,500 per violation, enforced by the Texas Attorney General.

Does This Law Apply to Your Business?

The TDPSA applies to entities that:

Conduct business in Texas or produce products/services consumed by Texas residents
Process or engage in the sale of personal data
Are not a small business as defined by the SBA (note: small businesses have some exemptions but are not fully exempt)

⚠️ Important: "Small Business" Doesn't Mean Exempt

Small businesses under the SBA definition have some exceptions (e.g., consent requirements for data sales), but they must still honor consumer rights like access, deletion, and opt-out requests. Don't assume you're exempt.

Consumer Rights Under the TDPSA

Texas consumers now have the right to:

Access: Know what personal data a business has collected about them
Correction: Request correction of inaccurate personal data
Deletion: Request deletion of their personal data
Data Portability: Obtain their data in a portable, readily usable format
Opt-Out: Opt out of data sales, targeted advertising, and profiling

Businesses must respond to consumer requests within 45 days (with a possible 45-day extension). You must also provide a clear, accessible way for consumers to submit these requests — typically a form on your website or a dedicated email address.

Compliance Checklist for San Antonio Businesses

✅ Update your privacy policy to disclose what data you collect, why, and with whom you share it
✅ Implement a data request process — create a form or email workflow for access, deletion, and opt-out requests
✅ Audit your data collection — map what personal data your website, CRM, and marketing tools collect
✅ Add consent mechanisms for data sales and targeted advertising (cookie consent banners, preference centers)
✅ Review vendor contracts — ensure your third-party processors have data processing agreements in place
✅ Implement data security measures — encryption, access controls, and breach notification procedures
✅ Train your team — employees handling consumer data must understand their obligations

How This Affects Your Website

Your website is often the primary point of data collection. Key changes to implement:

Cookie consent banner: Must offer opt-out for tracking cookies used in targeted advertising
Privacy policy: Must be updated with TDPSA-specific disclosures
Contact forms: Must disclose how submitted data will be used
"Do Not Sell My Data" link: Required if you share consumer data with third parties for advertising

Need Help with TDPSA Compliance?

Hatty AI helps San Antonio businesses implement privacy compliance — from website updates to data mapping and policy creation.

Schedule a Compliance Consultation

Frequently asked questions

When was the Texas Data Privacy and Security Act signed?

The TDPSA was signed into law in June 2023 and, according to the post, is in full enforcement in 2026. It gives Texas consumers new rights over their personal data.

Who must comply with the TDPSA?

It applies to entities that conduct business in Texas or produce products or services consumed by Texas residents, and that process or sell personal data. The post notes an exception for entities that qualify as small businesses as defined by the SBA.

What are the penalties under the TDPSA?

The post says penalties can reach up to $7,500 per violation, enforced by the Texas Attorney General.

Texas Data Privacy and Security Act (TDPSA) 2026: What to Know