Texas Cybersecurity Law: What Every Business Must Know

⏱ 6 min read

Texas cybersecurity law already applies to your business, whether you know it or not — regardless of size or industry. If you have customer names, addresses, or any other personal information on file, Texas law already has expectations of you — and most businesses misjudge exactly what those expectations are. There’s no small-business exemption. There’s no ‘we’re too small for that to apply to us.’ The obligation exists the moment you hold the data.

Here’s the foundation everyone needs, then where it gets more demanding depending on who you are.

The Floor: What Texas Requires of Every Business

Chapter 521 of the Texas Business & Commerce Code sets the baseline. Two things matter most:

You have to use reasonable procedures to protect sensitive personal information from unauthorized access. The law doesn’t hand you a checklist — “reasonable” is the standard, and that ambiguity is exactly why most owners assume they’re covered when they’re not.

If a breach happens, you have 60 days from the moment you discover it to notify affected Texas residents — not 60 days from when you finish investigating, and not 60 days from when you go public with it. The clock starts the moment you know, whether or not the full picture is clear yet. If 250 or more Texans are affected, the Texas Attorney General gets notified too.

There is no revenue ceiling or minimum employee count to these obligations. A solo consultant and a 500-person firm carry the identical baseline duty. That surprises almost everyone the first time they hear it.

Here’s where most owners get the definition wrong, too. A name and address sitting together is real data and worth protecting, but on its own it doesn’t trigger Chapter 521’s specific duty. The law’s trigger is narrower and sharper: a person’s name combined with something like a Social Security number, a driver’s license or government ID number, or a financial account number paired with the code that unlocks it. Health information tied to an individual counts too. Add any one of those to a name, and you’ve crossed into “sensitive personal information” — the category that obligates you to notify.

The trap is thinking “we don’t store that, our SaaS vendor does” gets you off the hook. It doesn’t. Your CRM, your payroll provider, your scheduling tool, your invoicing platform — somewhere in that stack sits exactly the combination the law is talking about, even if you never touch the database yourself. And when that vendor gets breached, the state and the plaintiff’s attorney don’t go knocking on the vendor’s door first. They come after you, the business that collected the data and chose the vendor. Third-party risk isn’t a side issue — it’s where most of the actual exposure lives, because most owners have outsourced the storage of sensitive data without outsourcing the liability for it.

The Carrot: How Texas Cybersecurity Law Rewards Compliance (SB 2610)

In 2025, Texas added something new on top of the floor — not a new obligation, but a reward for businesses that go further. Senate Bill 2610 gives businesses under 250 employees a safe harbor: if you can show you had a qualifying cybersecurity program actively in place at the time of a breach, you’re protected from punitive damages in a related lawsuit.

This is where the soapbox comes out, because it’s the part everyone misses: the protection only kicks in if you can demonstrate, after the fact, that the program was actually running when the breach happened.

The bar scales by size: under 20 employees, basic safeguards like password policy and security awareness training; 20 to 99 employees, moderate controls aligned to CIS Controls Implementation Group 1; 100 to 249 employees, a full recognized framework like NIST CSF or HITRUST CSF.

This Is Just the Starting Point

Here’s what most owners don’t realize: Chapter 521 and SB 2610 are the floor for everyone. If your business carries other compliance obligations — and more businesses do than think they do — those sit on top of the state baseline, not instead of it.

Take CPAs and tax preparers as a clear example. Under the FTC Safeguards Rule and IRS Publication 4557, every paid tax preparer — solo practitioner or fifty-person firm, no exception for size — is legally required to maintain a Written Information Security Plan, a WISP. Not a security tool. Not a vendor relationship. A specific written document naming who’s responsible, documenting a risk assessment, and detailing the safeguards in place. Firms have lost their PTIN over this. Firms have faced FTC penalties running into tens of thousands of dollars per violation, per day, for operating without one.

That’s the pattern to watch for in your own industry. PCI DSS if you touch card data. HIPAA if you touch health records. GLBA if you’re anywhere near financial services. Each one stacks its own specific, often more prescriptive requirements on top of Texas cybersecurity law — and “I didn’t know I was covered” has never once worked as a defense.

Why This Is What TC21 Was Built For

This is exactly the gap TOPCYBER21 closes for our global customer family, starting right here in our home state of Texas. We take a "protect first, document after, and adapt accordingly" approach to the core 21 security areas every organization should address. We start with our comprehensive TC21 rapid risk assessment, and help your business "inspect what you expect," to get in front of inquiries from regulators, plaintiff’s attorneys, or insurance adjusters. The proof you need to demonstrate your security controls existed and excelled — before an incident happened.

Whether you’re trying to clear the Chapter 521 floor, qualify for the SB 2610 safe harbor, or maintain a WISP your PTIN renewal depends on, the underlying discipline is the same: have it in writing, keep it current, be able to produce it the day someone asks. That includes your vendors — a documented program has to account for where your sensitive data actually lives, not just where you assume it does. TC21 maps directly to what SB 2610’s tiers require. That’s a conversation, not a checklist.

About the Author

Matt Tankersley, CISSP is a US Navy combat veteran, Founder & CEO of TechOnPurpose, and creator of the TOPCYBER21™ Framework. With 35+ years in IT and cybersecurity, he helps organizations STOP the #CYBERinsanity and build real, layered protection that works.

About TechOnPurpose

At TechOnPurpose, we help organizations move from under-resourced and "stuck in the cybersecurity headlights" to fully supported and protected in hours or days—not weeks. Through comprehensive IT support and our TOPCYBER21™ framework, we assess cyber risk in 15 minutes and build defense-in-depth protection fast. As a veteran-owned MSSP and globally recognized Top 250 provider, we don't just support and secure—we elevate the role of trusted technology partner.