TDPSA Compliance Checklist for Businesses (2026)

If your business operates in Texas or serves Texas residents, the Texas Data Privacy and Security Act (TDPSA), Tex. Bus. & Com. Code ch. 541, effective July 1, 2024, may impose controller obligations on you. Unlike other state privacy laws that set fixed consumer-volume or revenue thresholds, the TDPSA uses the U.S. Small Business Administration's industry-specific size standards as the single applicability gate, meaning many mid-size companies that assume they are too small to comply may actually be fully covered. This ten-step checklist walks through every controller duty, from the applicability self-test to processor contracts and enforcement exposure, so you can assess your compliance posture or close gaps before the Texas AG's 30-day notice letter arrives.

For a plain-language overview of what the TDPSA requires, see the companion explainer. For detail on the five rights your Texas customers can invoke against your business, see consumer rights under the TDPSA.

Step 1: Run the Applicability Self-Test

The TDPSA's applicability gate is unlike every other major state privacy law. There is no fixed revenue threshold, no 100,000-consumer floor, and no percentage-of-revenue-from-data-sales test. The only gate is whether your business qualifies as a small business under the U.S. Small Business Administration's size standards. Tex. Bus. & Com. Code § 541.002(a).

The SBA's size standards are set by NAICS industry code and are published at 13 C.F.R. Part 121. Most retail and service-sector businesses are measured by average annual receipts, which 13 C.F.R. 121.104(c)(1) computes as the total receipts of the concern over its most recently completed five fiscal years divided by five. Most manufacturing and wholesale businesses are measured by average number of employees, which 13 C.F.R. 121.106(b)(1) computes from the number of employees for each of the pay periods over the preceding completed 24 calendar months. Thresholds commonly range from $7.5 million to $47 million in receipts for retail and service industries and from 500 to 1,500 employees for manufacturing. Look up your specific NAICS code using the SBA's Size Standards Tool at sba.gov/size-standards.

Two aggregation rules matter. First, you must count affiliated entities when calculating size, so a business with a large parent or holding company may exceed the threshold even if the operating subsidiary alone would not. Second, calculate size for each industry in which you operate, because a business that straddles two sectors may meet the small-business standard in one but not the other.

If your business exceeds the SBA threshold for its primary industry, the TDPSA applies in full and you should proceed through all remaining steps. If you fall under the threshold as a true SBA small business, most TDPSA obligations do not apply, but stop before assuming full exemption: § 541.107 still bars you from selling sensitive personal data without prior consumer consent regardless of your size-standard status.

Document your self-test conclusion with the NAICS code you used, the applicable size standard, and the annual receipts or employee count that produced your result. If the AG ever investigates, a documented threshold analysis is far more persuasive than a claim that the TDPSA simply did not apply.

Step 2: Confirm Whether an Entity or Data Exemption Applies

Even if your business exceeds the SBA size threshold, the TDPSA contains categorical entity exemptions that remove entire classes of organizations from the law's reach. Under Tex. Bus. & Com. Code § 541.002(b), the following entities are fully exempt: Texas state agencies and political subdivisions; financial institutions and their affiliates subject to Title V of the Gramm-Leach-Bliley Act; HIPAA covered entities and business associates; nonprofit organizations; institutions of higher education; and electric utilities and power generation companies.

Beyond entity-level exemptions, specific categories of data are carved out under § 541.003 regardless of which company holds them. Exempt data categories include HIPAA protected health information, health records, patient safety work product, and certain deidentified health datasets; FCRA-regulated consumer credit data; Driver's Privacy Protection Act motor vehicle data; FERPA educational records; Farm Credit Act data; personal data processed in the employment, independent contractor, or job application context; emergency contact information; and benefits administration data.

The entity exemption and the data exemption are independent tests that you must run separately. A HIPAA-covered hospital is entity-exempt across its entire operation. A non-HIPAA software company may still process some HIPAA-regulated data streams as a business associate, which are exempt at the data level even though the company itself is covered by the TDPSA for its other data activities.

Apply a dual check to every data stream: first, does an entity-level exemption remove your entire organization from coverage? Second, even if your organization is covered, does a data-category exemption remove this particular data type from TDPSA requirements? Only after both checks should you treat a stream as governed by the TDPSA's full controller duty stack.

Step 3: Map Your Sensitive Data and Prepare Opt-In Consent Flows

The TDPSA's most demanding consumer-facing obligation is its requirement for affirmative opt-in consent before processing sensitive data. This is not an opt-out standard that allows collection to begin while offering a later unsubscribe. You need an informed, voluntary yes before any sensitive data processing begins. Tex. Bus. & Com. Code § 541.101(b)(4).

The TDPSA defines sensitive data in § 541.001 through four statutory subparagraphs. The first covers personal data revealing racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexuality, or citizenship or immigration status. The second covers genetic or biometric data that is processed for the purpose of uniquely identifying an individual, which under the chapter's separate definition of biometric data reaches fingerprints, voiceprints, and eye retina or iris patterns. The third covers personal data collected from a known child. The fourth covers precise geolocation data. Review every product, analytics tool, advertising platform, health form, account profile, and user-generated field in your systems against this list.

The list is broader than most businesses expect. A wellness app that invites users to log symptoms is processing health diagnosis data. A mobile app that shares GPS coordinates with advertising partners is processing precise geolocation data. An HR platform that collects employee biometrics for time-and-attendance is processing biometric data. A loyalty program that infers demographic characteristics from purchase history and applies them to advertising segments may be generating sensitive data even without explicit user disclosure.

For each sensitive data stream you identify, build a granular opt-in mechanism that clearly names the sensitive data type being collected, explains the specific purpose, and offers a genuine choice to decline without stripping access to the core service where reasonably possible. Pre-checked boxes, general terms-of-service bundling, and passive scroll-through consents do not satisfy an affirmative opt-in standard.

For data collected from children known to be under 13, § 541.101(b)(4) directs compliance with COPPA's verifiable parental consent framework rather than direct consumer consent. If your service is directed at children or you have actual knowledge you are collecting data from a child, COPPA compliance is the required mechanism.

Step 4: Post Mandatory Sale Notices for Sensitive and Biometric Data

This is one of the most distinctive requirements in the TDPSA and one that has no direct parallel in most other state privacy laws. If your business sells sensitive personal data to third parties, you must post a notice using the exact statutory language specified in Tex. Bus. & Com. Code § 541.102(b): "NOTICE: We may sell your sensitive personal data."

If your business separately sells biometric personal data, an additional verbatim notice is required under § 541.102(c): "NOTICE: We may sell your biometric personal data."

Both notices are requirements in addition to, not instead of, the general opt-out disclosure required whenever any personal data is sold. A company that sells both sensitive data and biometric data must post all three disclosures: the general sale opt-out, the sensitive-data verbatim notice, and the biometric-data verbatim notice.

The statute is specific about placement. Sections 541.102(b) and 541.102(c) each require that the notice be posted in the same location and in the same manner as the privacy notice described by Subsection (a). There is no alternative-placement option. Because Subsection (a) requires that privacy notice to be reasonably accessible and clear, burying either sale notice in the fifteenth paragraph of a dense privacy policy or rendering it in eight-point gray text on a white background does not meet that standard. Consider positioning both notices near the top of your privacy notice, above the fold, in formatted callout text.

Crucially, even SBA small businesses that are otherwise exempt from the TDPSA's controller obligations are still prohibited from selling sensitive data without the consumer's prior consent under § 541.107. The small-business exemption does not reach this provision. Note that the verbatim notice requirement in § 541.102(b)-(c) is a controller obligation and applies to non-exempt businesses that engage in data sales; small businesses subject only to § 541.107 must obtain consent, but their specific disclosure obligations are governed by that section rather than the full § 541.102 controller privacy-notice framework.

Step 5: Update Your Privacy Notice

A TDPSA-compliant privacy notice must contain six mandatory elements under Tex. Bus. & Com. Code § 541.102. First, the categories of personal data you process, with explicit identification of any sensitive data categories. Second, the purposes for which you process each category of personal data. Third, how consumers may exercise their five statutory rights and the process for appealing a denial of a rights request. Fourth, the categories of personal data you share with third parties. Fifth, the categories of third parties with whom you share personal data. Sixth, the methods by which consumers may submit rights requests, such as an email address, web form, or toll-free phone number.

If your business sells personal data to third parties or processes personal data for targeted advertising, the notice must also include a clear, conspicuous disclosure of that practice and a working mechanism for consumers to opt out. Tex. Bus. & Com. Code § 541.103.

Targeted advertising is defined narrowly. Displaying ads based on data collected from consumer activity across nonaffiliated websites or applications over time qualifies. Displaying contextual ads based on activity within your own site or app at the time of the visit does not. Make sure your disclosure accurately describes which advertising practices your business actually engages in so the notice is neither over-inclusive nor misleading.

The privacy notice must be reasonably accessible. This means it should be linked prominently from your homepage and from every point of data collection, not just buried in your site footer or accessible only through a nested help page. If you add the mandatory sale notices described in Step 4, integrate them visibly near the top of the notice document.

For full detail on each consumer right, including access, correction, deletion, portability, and opt-out, and for the exact 45-day response timeline and appeal process, see the companion consumer rights under the TDPSA spoke.

Step 6: Implement the Universal Opt-Out Mechanism

As of January 1, 2025, controllers subject to the TDPSA must honor universal opt-out signals submitted on behalf of Texas consumers. This obligation is codified in Tex. Bus. & Com. Code § 541.055(e), which took effect six months after the TDPSA's main provisions launched on July 1, 2024.

A universal opt-out mechanism is defined broadly to include browser settings and extensions (such as Global Privacy Control signals), links to dedicated opt-out internet pages, and global settings on electronic devices. When a consumer or their designated authorized agent sends a recognized signal, you must process the opt-out with commercially reasonable effort, including verifying Texas residency and the agent's authority to act on the consumer's behalf.

Under Tex. Bus. & Com. Code § 541.055(b) you may not require a consumer to create a new account in order to exercise rights under this subchapter, though you may require a consumer to use an existing account. The universal opt-out mechanism is built so that browser-level and device-level signals can be honored without forcing a consumer to open a new account with you.

Businesses that were already honoring Global Privacy Control signals for compliance with California's CPRA should review whether their implementation also satisfies the TDPSA's version of the requirement, particularly the Texas-residency verification component. Signals that work across all U.S. states may need to be augmented to ensure proper state-specific handling.

Any delay in recognizing and processing universal opt-out signals is a curable violation within the AG's 30-day notice framework. The practical implication is that upon receiving a written notice from the AG, you have 30 days to implement signal recognition, confirm in writing that you have done so, and document the remediation for the file.

Step 7: Conduct and Document Data Protection Assessments

Written Data Protection Assessments (DPAs) are mandatory for five categories of processing under Tex. Bus. & Com. Code § 541.105(a). The five triggers are: processing personal data for targeted advertising; selling personal data; processing personal data for profiling that presents a reasonably foreseeable risk of unfair or deceptive treatment, financial injury, physical injury, reputational harm, intrusion on solitude or seclusion, or other substantial consumer injury; processing sensitive data; and any other processing that presents a heightened risk of harm to consumers.

Each assessment must weigh the benefits of the processing activity against the risks to consumers, taking into account several factors: the extent to which deidentified data could substitute for personal data, consumer reasonable expectations about how their data will be used, the nature and context of the processing relationship, and whether safeguards in place adequately mitigate the identified risks. Tex. Bus. & Com. Code § 541.105(b).

One assessment may cover a set of comparable processing operations rather than requiring a separate document for every individual campaign, data-sharing agreement, or product feature. If you run five targeted advertising campaigns that use identical data types, purposes, and safeguards, a single well-documented DPA covering that program is defensible. If a campaign materially changes the data types used or the consumer population targeted, refresh the assessment.

The Texas AG may require a controller to disclose a data protection assessment relevant to an investigation, and completed assessments are protected from public disclosure while in the AG's possession. Tex. Bus. & Com. Code § 541.105(c)-(d). Treat completed DPAs as sensitive legal documents from the outset: involve legal counsel, maintain them in a confidential records system, and note any attorney-client privilege claims on the document itself.

Timing also matters. Begin DPAs before a new processing activity launches, not after. A DPA completed retroactively after a complaint is less credible than one that was part of the product design process.

Step 8: Execute Written Processor Contracts

Every service provider, vendor, or third party that processes personal data on your behalf, under your instructions, must be governed by a binding written controller-processor contract before any personal data is shared or accessed. Tex. Bus. & Com. Code § 541.104(b). There are no de minimis exceptions for small vendors or short-term engagements.

The contract must specify five structural elements: the instructions for processing personal data; the nature and purpose of the processing; the type of data subject to processing; the duration of processing; and the rights and obligations of both parties. These elements define the outer boundaries of what the processor is authorized to do. Any processing outside those defined parameters makes the processor a controller in its own right, with its own liability exposure.

Beyond the structural scope elements, the contract must impose five operational obligations on the processor: a duty to ensure all personnel who access personal data are bound by confidentiality obligations; a duty to delete or return all personal data to you upon termination or request, unless law requires longer retention; a duty to provide information sufficient for you to assess its compliance with the TDPSA; a duty to cooperate with and permit reasonable controller audits or independent third-party assessments of its data practices; and a duty to flow down equivalent data protection obligations to any subprocessors it engages through written contracts.

Effective January 1, 2026, Acts 2025, 89th Leg., R.S., Ch. 1174 (H.B. 149, the Texas Responsible AI Governance Act) amended Section 541.104(a)(2) so that a processor's duty to assist the controller with data-security compliance now explicitly extends to personal data collected, stored, and processed by an artificial intelligence system as defined in Section 551.001. If a processor contract covers a vendor that trains, operates, or supports an AI system using personal data you control, confirm the assistance and security provisions reach that AI-system data specifically.

Begin with a vendor inventory. List every third party that touches personal data you control: cloud infrastructure providers, analytics platforms, marketing automation tools, payment processors, CRM systems, customer support software, and any other SaaS or services platform that ingests or stores data from your systems. Determine whether each relationship is a processor (acting under your instructions) or a third-party controller (acting for its own purposes), because the distinction determines whether a data processing agreement or a data-sharing agreement is the right instrument.

Step 9: Build Consumer Request Workflows

Texas consumers have five statutory data rights under the TDPSA. They may ask you to confirm whether you process their personal data and to obtain a copy of it. They may ask you to correct inaccuracies in personal data you maintain about them. They may ask you to delete personal data you hold about them. They may ask for a portable copy of their data in a readily usable format that enables transfer to another controller. And they may opt out of three specific uses: targeted advertising, sale of personal data, and profiling used to make decisions with legal or similarly significant effects on the consumer.

Controllers must respond to authenticated requests within 45 days of receipt. One extension of up to an additional 45 days is permitted if the controller notifies the consumer within the initial period of the reason for delay. Responses must be provided free of charge twice per calendar year per consumer; reasonable fees may apply to manifestly unfounded or excessive additional requests.

If you deny a request, you must inform the consumer of the reason for the denial and provide them with a method to appeal. Under Tex. Bus. & Com. Code § 541.053(a) the consumer has a reasonable period of time after receiving your decision in which to file that appeal. Your own deadline is fixed: § 541.053(c) requires you to inform the consumer in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decision, not later than the 60th day after the date you receive it. If the appeal is denied, § 541.053(d) requires you to provide the consumer with the online mechanism described by § 541.152 through which the consumer may contact the Texas Attorney General to submit a complaint.

Build the appeal mechanism as a documented, internal workflow rather than a generic support ticket queue. The TDPSA's appeal chain is not satisfied by a "contact us" email. Designate a privacy team member responsible for appeals, document each decision with reasoning, and maintain records of the AG referral step that consumers receive when appeals are denied.

Step 10: Understand Enforcement, the Cure Period, and the Allstate Warning

The Texas AG is the sole enforcer of the TDPSA. The statute expressly provides that it may not be construed as providing a basis for a private right of action, meaning no individual consumer, plaintiff's law firm, or class action can sue your company for a TDPSA violation. Tex. Bus. & Com. Code §§ 541.151, 541.156.

Before initiating any enforcement action, the AG must provide written notice identifying the specific statutory provisions alleged to have been violated. You then have 30 days to cure the identified violations and provide a written statement to the AG confirming the cure and the compliance measures implemented. If you cure successfully within that window, no enforcement action may be initiated for that specific violation. Tex. Bus. & Com. Code § 541.154. Unlike California's CPRA, which capped its cure period for certain violations, the TDPSA cure period does not have a sunset date as currently enacted.

If the 30-day period expires without a satisfactory cure, or if you later violate a written cure commitment, the AG may seek civil penalties of up to $7,500 per violation, injunctive relief, and recovery of reasonable attorney fees and court costs. Tex. Bus. & Com. Code § 541.155.

The per-violation framing matters. A business that processes precise geolocation data of 45,000 Texas consumers without consent does not face a single $7,500 fine. Depending on how the AG counts violations, the exposure could be measured in hundreds of millions of dollars.

The AG has already demonstrated its enforcement intent. In January 2025, the AG filed the first enforcement action by any state attorney general to enforce a comprehensive data privacy law, suing Allstate and its data analytics subsidiary Arity for allegedly paying mobile app developers to secretly embed tracking software that collected precise geolocation data from more than 45 million Americans, including Texans, and selling that data to insurance companies without consumer knowledge or consent. The case directly targets sensitive-data consent and notice obligations, which the Allstate lawsuit signals are the AG's enforcement priority.

The practical takeaway: build your sensitive-data consent mechanisms and mandatory sale notices before you receive an AG notice letter, not after. The cure period is a last resort, not a compliance plan.

Related guides

• What Is the TDPSA? Texas Data Privacy and Security Act
• TDPSA Consumer Rights: Your Texas Data Privacy Rights
• Texas Data Privacy Laws: TDPSA & Consumer Rights Guide (2026)
• Texas Biometric Privacy Laws: Collection, Consent & Penalties (2026)
• US State Privacy Laws Comparison Chart (2026)

More Texas Laws

• Texas Deepfake Laws
• Texas Employee Monitoring Laws
• Texas GPS Tracking Laws
• Texas Recording Laws

Frequently Asked Questions

Does the TDPSA apply to my small business?

If your business qualifies as an SBA small business under 13 C.F.R. Part 121 for your specific NAICS industry code, most TDPSA controller obligations do not apply. However, even SBA small businesses are prohibited from selling sensitive personal data without prior consumer consent under Tex. Bus. & Com. Code § 541.107. To determine your threshold, look up your NAICS code at sba.gov/size-standards and calculate size including all affiliates.

What is the difference between opt-in and opt-out under the TDPSA?

The TDPSA requires affirmative opt-IN consent before processing sensitive data. You need a clear, informed yes before any collection or processing of sensitive categories begins. For non-sensitive personal data used in targeted advertising or sold to third parties, the standard is opt-OUT: you may process the data unless and until the consumer objects. Understanding this distinction is critical because the wrong standard applied to sensitive data is precisely the type of violation the Allstate enforcement action targets.

What exactly must the mandatory sale notices say?

The statute specifies verbatim text that cannot be paraphrased. If you sell sensitive personal data, the notice must read exactly: 'NOTICE: We may sell your sensitive personal data.' If you separately sell biometric personal data, the notice must read exactly: 'NOTICE: We may sell your biometric personal data.' Under Tex. Bus. & Com. Code §§ 541.102(b) and 541.102(c), each notice must be posted in the same location and in the same manner as the privacy notice required by § 541.102(a).

Are nonprofits subject to the TDPSA?

No. Nonprofit organizations are categorically exempt from the TDPSA under Tex. Bus. & Com. Code § 541.002(b)(4). A nonprofit that processes personal data of millions of Texas residents has no TDPSA controller obligations. The nonprofit may still have obligations under HIPAA, COPPA, or other federal or state laws depending on the nature of the data it processes.

Does the TDPSA have a private right of action?

No. Tex. Bus. & Com. Code § 541.156 expressly states the TDPSA may not be construed as providing a basis for a private right of action. Only the Texas Attorney General can enforce the law. This is a meaningful structural protection compared to state biometric laws like Illinois BIPA, which allows individual lawsuits and has generated substantial class action liability.

How long is the TDPSA cure period, and does it sunset?

The cure period is 30 days after the AG's written notice identifying specific violations. If you cure successfully and provide written confirmation of the remediation, the AG may not bring an enforcement action for that violation. Unlike some other state privacy laws, the TDPSA cure period does not have a scheduled sunset date under the current text of Tex. Bus. & Com. Code § 541.154.

What is the maximum penalty for a TDPSA violation?

Civil penalties of up to $7,500 per violation. The AG may also seek injunctive relief and recover reasonable attorney fees and court costs under Tex. Bus. & Com. Code § 541.155. Because the penalty applies per violation rather than per enforcement action, the aggregate exposure for mass-scale processing violations can be enormous, as illustrated by the Allstate lawsuit alleging violations affecting 45 million consumers.

Do I need a data protection assessment for all of my data processing?

No. DPAs are required only for processing activities that present a heightened risk: targeted advertising, selling personal data, risky profiling, sensitive data processing, and any other high-risk processing under Tex. Bus. & Com. Code § 541.105(a). Routine business processing that falls outside those five categories does not require a formal DPA. However, maintaining a brief written record of your threshold analysis for borderline activities is a best practice, since the AG can demand DPAs during an investigation.