Skip to content
Network USA

TX · Breach notification statute

Texas data breach notification law

A summary of the Texas breach notification statute from the Privacy Rights Clearinghouse 2026 survey (laws as of 1 January 2026). This is not legal advice. Verify against the current statute and your state attorney general.

Summary

Statute citation

Tex. Bus. & Com. Code §§ 521.001-.152 (Identity Theft Enforcement and Protection Act) (amended 2023)

Last amended
2023 (as stated in the citation)
Source
PRC Data Breach Notification Laws Survey 2026

Who must notify and when

no later than 60 days after determining the breach occurred.33

Attorney general notice

Yes Texas requires AG notification as soon as practicable and no later than 30 days after determining the

What counts as a breach

In Texas 'breach of system security' means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of sensitive personal information maintained by a person, including data that is encrypted if the person accessing the data has the key required to decrypt the data; good faith acquisition of sensitive personal information by an employee or agent of the person for the purposes of the person is not a breach of system security unless the person uses

What counts as personal information

Not extracted in our PRC 2026 summary; check the statute.

Coverage and remedies

Biometric dataNo
Medical informationYes
Government ID numbersNot extracted
Paper recordsNo
Private right of actionNo
Credit monitoring requiredNo

"Not extracted" means the field was not captured in our PRC 2026 summary; check the statute.

HIPAA breaches reported in Texas

656 reports to HHS OCR affecting 49,863,944 individuals. Most common type: Hacking/IT Incident. See all HIPAA breaches in Texas.

Five largest

HIPAA breach reports from the HHS OCR Breach Portal
Covered entityEntity typeIndividualsSubmittedType of breachStatus
Concentra Health Services, Inc.Healthcare Provider3,998,163Jan 9, 2024Hacking/IT IncidentArchive (closed)
Baylor GeneticsHealthcare Provider2,810,878Aug 14, 2026Hacking/IT IncidentUnder investigation
ESO Solutions, Inc.Business Associate2,700,000Dec 18, 2023Hacking/IT IncidentArchive (closed)
NEC Networks, LLC d/b/a CaptureRxBusiness Associate2,600,000May 5, 2021Hacking/IT IncidentArchive (closed)
WebTPA Employer Services, LLC (“WebTPA”)Business Associate2,518,533May 8, 2024Hacking/IT IncidentArchive (closed)

Frequently asked questions

When must Texas businesses notify individuals of a data breach?

Our PRC 2026 extract summarises the Texas timing rule as: "no later than 60 days after determining the breach occurred.33". (Source: PRC 2026 survey extract.)

Does Texas require notice to the attorney general?

The PRC 2026 extract notes: "Yes Texas requires AG notification as soon as practicable and no later than 30 days after determining the". (Source: PRC 2026 survey extract.)

Does the Texas law cover biometric data?

No. The PRC 2026 survey does not record biometric data as covered by the Texas breach law.

Does the Texas law cover medical information?

Yes. The PRC 2026 survey records medical information as covered by the Texas breach law.

Does the Texas law cover paper records?

No. The PRC 2026 survey records the Texas law as covering computerised data only, not paper records.

Is there a private right of action in Texas?

No. The PRC 2026 survey does not record a private right of action under the Texas breach law.

Is credit monitoring required in Texas?

No. The PRC 2026 survey does not record a credit monitoring requirement in Texas.

How does the Texas law relate to HIPAA?

HIPAA covered entities and business associates follow the federal HIPAA Breach Notification Rule for protected health information. State breach laws can apply alongside it, and some state statutes treat HIPAA compliance as satisfying state duties. Check the Texas statute, and see our HIPAA vs state breach notification laws guide.

Sources