# Regulatory Standards — Texas TDPSA

## Primary Legislation

### Texas Data Privacy and Security Act — Tex. Bus. & Com. Code §541.001-§541.203

Enacted: June 18, 2023 (HB 4). Effective: July 1, 2024.

- **§541.001**: Definitions
- **§541.002**: Applicability (no revenue/consumer count threshold for non-small businesses)
- **§541.003**: Exemptions (government, GLBA, HIPAA, nonprofits, higher ed, electric utilities)
- **§541.051-§541.055**: Consumer rights (access, correct, delete, portability, opt-out, appeal)
- **§541.101-§541.107**: Controller duties, privacy notice, DPAs, sensitive data
- **§541.103**: Data protection assessments
- **§541.151-§541.155**: AG enforcement, 30-day cure, penalties up to $7,500
- **§541.201-§541.203**: Data broker registration and requirements

### Texas Capture or Use of Biometric Identifier Act (CUBI) — Tex. Bus. & Com. Code §503.001

Enacted: 2009. Provides:
- Definition of biometric identifier (retina/iris scan, fingerprint, voiceprint, hand/face geometry)
- Informed consent requirement before capture
- Prohibition on sale, lease, or disclosure without consent
- Storage and destruction requirements
- AG enforcement; penalties up to $25,000 per violation

## Small Business Determination

### SBA Size Standards (13 CFR §121.201)

The TDPSA exempts "small businesses as defined by the U.S. Small Business Administration." SBA size standards vary by NAICS code:

| NAICS Code | Industry | Size Standard |
|------------|----------|---------------|
| 454110 | Electronic shopping and mail-order houses | $40M annual receipts |
| 423 | Merchant wholesalers (durable goods) | Varies by subsector |
| 518210 | Data processing, hosting, related services | $35M annual receipts |
| 541511 | Custom computer programming services | $34M annual receipts |

Liberty Commerce Inc. (NAICS 454110): Annual revenue of $48M exceeds the $40M threshold, so it is NOT a small business and all TDPSA provisions apply.

## Comparison with Other State Laws

| Provision | TDPSA (Texas) | CCPA/CPRA (California) | VCDPA (Virginia) |
|-----------|--------------|----------------------|------------------|
| Revenue/consumer threshold | None (non-small business) | $25M OR 100K consumers OR 50% revenue | 100K consumers OR 25K + 50% revenue |
| Private right of action | No | Yes (data breach only) | No |
| Cure period | 30 days (permanent) | Eliminated by CPRA | 30 days (permanent) |
| Data broker registration | Yes | No (separate Delete Act) | No |
| Biometric law | CUBI (separate) | CCPA covers biometric PI | VCDPA sensitive data |
| Nonprofit exemption | Yes | No | Yes |
| Universal opt-out | Not required | Required (GPC) | Not required |

## Related Texas Laws

### Texas Identity Theft Enforcement and Protection Act — Tex. Bus. & Com. Code §521.001

Breach notification within 60 days to affected individuals; notification to AG for breaches affecting 250+ residents.

### Texas Deceptive Trade Practices — Consumer Protection Act — Tex. Bus. & Com. Code §17.41

Framework for AG enforcement of TDPSA violations. Provides for civil penalties, injunctive relief, and attorney fees.