Texas Privacy Compliance Checklist

Texas Data Privacy and Security Act — Step-by-step guide to compliance

Reviewed by PrivacyLawMap editorial teamLast verified: July 28, 2026

Compliance Steps

Effective: July 1, 2024 | Cure period: 30 days

Determine applicability: check if your organization qualifies as a "small business" under the SBA definition for your specific NAICS code. For most tech/software companies, the threshold is $41.5M in average annual receipts or 500-1,500 employees. Also verify HIPAA, GLBA, and FERPA exemptions — these apply at the entity level for covered entities and at the data level for covered data types

Conduct a comprehensive data inventory: map all personal data you collect, process, and share about Texas consumers. Identify sensitive data categories (racial/ethnic origin, religious beliefs, health data, sexual orientation, citizenship status, biometrics) that require opt-in consent. Document data flows to processors and third parties

Implement universal opt-out signal recognition (GPC and similar mechanisms) — this is an active AG enforcement priority. Ensure GPC signals are detected server-side and propagated to all downstream processors and advertising partners. Test across browsers and devices

Conduct data protection assessments for all high-risk processing activities: targeted advertising, data sales, profiling that produces legal or similarly significant effects, processing sensitive data, and any processing creating foreseeable risk of substantial injury

If developing or deploying AI systems: assess TRAIGA (HB 149) obligations. Developers must provide risk documentation; deployers must conduct impact assessments for high-risk AI. Ensure AI systems do not process personal data in ways that enable unlawful discrimination

If a data processor: update agreements to include TDPSA-mandated provisions and TRAIGA AI-related data protection duties. Processors must assist controllers with consumer rights requests and data protection assessments

Update privacy notices with all TDPSA-required disclosures: categories of data collected, purposes of processing, categories of third parties receiving data, consumer rights and how to exercise them, sale/sharing disclosures, and contact information for the controller

Implement consumer rights request mechanisms with 45-day response period (extendable by 45 additional days with notice). Include identity verification procedures and maintain records of requests and responses

Obtain opt-in consent before processing sensitive personal data — consent must be freely given, specific, informed, and unambiguous. Implement age verification where feasible to avoid processing children's data without parental consent

Establish a documented appeals process for denied consumer requests — you must inform consumers of the appeal process and respond within 60 days. If the appeal is denied, provide a mechanism for the consumer to contact the AG

If operating as a data broker: register with the Texas Secretary of State as required by HB 4460 and pay annual fees. Post conspicuous data collection notices. Non-registration carries $100/day penalties that accrue from the effective date

Implement data minimization practices: collect only personal data that is adequate, relevant, and reasonably necessary for the disclosed purpose. Review and purge data that is no longer needed

Establish an ongoing compliance monitoring program: conduct regular GPC signal testing, update data protection assessments when processing activities change, train employees on consumer rights procedures, and document all compliance activities in preparation for potential AG inquiries

TDPSA Compliance Checklist FAQ

What is the TDPSA compliance checklist?

It is a 13-step plan organizations use to meet the Texas Data Privacy and Security Act (TDPSA), which took effect July 1, 2024. The steps below cover consumer-rights request handling, privacy-notice disclosures, opt-out mechanisms, data-processing agreements, and security safeguards required under Texas law.

Who has to comply with the Texas Data Privacy and Security Act?

The TDPSA generally applies to organizations that handle Texas residents' personal data above the law's revenue and data-volume thresholds. Whether it applies to you depends on the specifics — check your exact obligations with the free applicability calculator at /calculator rather than assuming.

What is the penalty for TDPSA non-compliance?

The Texas Attorney General can impose civil penalties of up to $7,500 per violation and a 30-day cure period to fix violations before a fine. There is no private right of action, so enforcement comes from the state, not individual lawsuits. Figures verified July 28, 2026.

Put TDPSA Into Practice on Your SiteSponsored

Termly builds and maintains a Texas-ready privacy policy, a consent banner that recognizes universal opt-out signals like GPC, opt-in consent capture for sensitive data, and a workflow for the access, deletion and correction requests TDPSA grants.

Start Free with Termly

Texas Privacy Compliance Checklist

Compliance Steps

Key Enforcement Details

Related Resources

TDPSA Compliance Checklist FAQ

What is the TDPSA compliance checklist?

Who has to comply with the Texas Data Privacy and Security Act?

What is the penalty for TDPSA non-compliance?

Does this law apply to you?

Official Resources