Compare tool
Compare state data breach notification laws
Choose up to six states. Fields come from the PRC 2026 survey extract; blanks show as not extracted.
| Field | Texas |
|---|---|
| Statute citation | Tex. Bus. & Com. Code §§ 521.001-.152 (Identity Theft Enforcement and Protection Act) (amended 2023) |
| Individual notice timing | no later than 60 days after determining the breach occurred.33 |
| Attorney general notice | Yes Texas requires AG notification as soon as practicable and no later than 30 days after determining the |
| Biometric data | No |
| Medical information | Yes |
| Government ID numbers | Not extracted |
| Paper records | No |
| Private right of action | No |
| Credit monitoring required | No |
| Breach definition (excerpt) | In Texas 'breach of system security' means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of sensitive personal information maintained by a person, including data that is encrypted if the person accessing the data has the key required to decrypt the data; good faith acquisition of sensitive personal information by an employee or agent of the person for the purposes of the person is not a breach of system security unless the person uses |