Texas TDPSA

United States

19 domains

33 controls

Texas Data Privacy and Security Act (Tex. Bus. & Com. Code Ch 541, effective 1 Jul 2024).

Verified

Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (19)

AI Governance

1 controls

Controls in the AI Governance domain of Texas TDPSA — 1 controls
Code	Title	Description
TDPSA-541-AI-CROSS	AI Cross-Reference (TRAIGA and Profiling)	The Texas Responsible AI Governance Act (TRAIGA, effective Jan 2026) interacts with TDPSA profiling and sensitive data p...

Automated Decisioning

1 controls

Controls in the Automated Decisioning domain of Texas TDPSA — 1 controls
Code	Title	Description
TDPSA-541-101-PROFILING	Profiling Producing Legal or Significant Effects	Profiling in furtherance of decisions that produce legal or similarly significant effects (e.g., financial, housing, emp...

Children

1 controls

Controls in the Children domain of Texas TDPSA — 1 controls
Code	Title	Description
TDPSA-541-053-CHILD	Children's Data and COPPA Alignment	Personal data of a known child (under 13) is sensitive personal data and must be processed in accordance with COPPA. For...

Consumer Rights

9 controls

Controls in the Consumer Rights domain of Texas TDPSA — 9 controls
Code	Title	Description
TDPSA-541-052-APPEAL	Consumer Appeal Process	Controllers must establish an internal appeal process if a consumer request is refused. Appeals must be decided within 6...
TDPSA-541-101-ACCESS	Consumer Right to Access	Consumers have the right to confirm whether a controller is processing their personal data and to access that personal d...
TDPSA-541-101-CORRECT	Consumer Right to Correction	Consumers may correct inaccuracies in their personal data, taking into account the nature of the data and the purposes o...
TDPSA-541-101-DELETE	Consumer Right to Deletion	Consumers may delete personal data provided by or obtained about the consumer.
TDPSA-541-101-NONDISCRIM	Non-Discrimination for Exercising Rights	Controllers may not discriminate against a consumer for exercising any of the rights under TDPSA, including denying good...
TDPSA-541-101-OPTOUT	Consumer Right to Opt Out (Targeted Ads, Sale, Profiling)	Consumers may opt out of processing of personal data for purposes of targeted advertising, sale of personal data, or pro...
TDPSA-541-101-PORT	Consumer Right to Data Portability	Consumers may obtain a copy of personal data they previously provided, in a portable and, to the extent technically feas...
TDPSA-541-103-RESPONSE	Consumer Request Response Timelines	Controllers must respond to consumer requests without undue delay and within 45 days of receipt. The period may be exten...
TDPSA-541-AUTH-AGENT	Authorized Agent Requests	Consumers may use an authorized agent (including by means of an internet link or browser setting) to opt out of targeted...

Data Handling

1 controls

Controls in the Data Handling domain of Texas TDPSA — 1 controls
Code	Title	Description
TDPSA-541-101-DEID	De-identified and Pseudonymous Data	If data is de-identified, the controller must take reasonable measures to ensure the data cannot be re-associated with a...

Data Minimization

1 controls

Controls in the Data Minimization domain of Texas TDPSA — 1 controls
Code	Title	Description
TDPSA-541-101-PURPOSE	Purpose Limitation and Data Minimization	Controllers must limit collection of personal data to what is adequate, relevant, and reasonably necessary in relation t...

Enforcement

2 controls

Controls in the Enforcement domain of Texas TDPSA — 2 controls
Code	Title	Description
TDPSA-541-203-AG	Texas AG Enforcement and 30-Day Cure	The Texas Attorney General has exclusive enforcement authority. Before bringing an action, the AG must provide written n...
TDPSA-541-AG-SWEEP	Texas AG Enforcement Posture and Sweeps	The Texas AG (through its Consumer Protection Division and Data Privacy and Security Initiative launched 2024) has issue...

Governance

1 controls

Controls in the Governance domain of Texas TDPSA — 1 controls
Code	Title	Description
TDPSA-541-GOVERN	Privacy Governance and Accountability	While TDPSA does not mandate a named DPO, controllers must demonstrate accountability through written policies, training...

Incident Response

1 controls

Controls in the Incident Response domain of Texas TDPSA — 1 controls
Code	Title	Description
TDPSA-541-BREACH	Breach Notification (Texas Identity Theft Act Cross-Reference)	TDPSA does not introduce a separate breach notification regime. Notification obligations remain under Texas Bus. & Com....

Lawful Basis

1 controls

Controls in the Lawful Basis domain of Texas TDPSA — 1 controls
Code	Title	Description
TDPSA-541-053-SENSITIVE	Sensitive Data Opt-In Consent	A controller may not process sensitive personal data without obtaining the consumer's freely given, specific, informed,...

People

1 controls

Controls in the People domain of Texas TDPSA — 1 controls
Code	Title	Description
TDPSA-541-TRAINING	Workforce Training and Awareness	Although not explicitly mandated, demonstrable workforce training is part of reasonable administrative safeguards and su...

Records

1 controls

Controls in the Records domain of Texas TDPSA — 1 controls
Code	Title	Description
TDPSA-541-RECORDS	Records of Consumer Requests and Decisions	Controllers should maintain records sufficient to demonstrate compliance, including DSAR receipts, response times, appea...

Registration

1 controls

Controls in the Registration domain of Texas TDPSA — 1 controls
Code	Title	Description
TDPSA-541-DATABROKER	Data Broker Registration Cross-Reference	Entities that meet the Texas data broker definition (Tex. Bus. & Com. Code Ch. 509, effective Sept 2023) must register a...

Risk Assessment

1 controls

Controls in the Risk Assessment domain of Texas TDPSA — 1 controls
Code	Title	Description
TDPSA-541-105-DPIA	Data Protection Assessments (DPIAs)	Controllers must conduct and document data protection assessments for: targeted advertising, sale of personal data, prof...

Scope

2 controls

Controls in the Scope domain of Texas TDPSA — 2 controls
Code	Title	Description
TDPSA-541-001	Applicability and Scope Determination	TDPSA applies to any person that conducts business in Texas or produces products/services consumed by Texas residents AN...
TDPSA-541-001-EXEMPT	Entity and Data Level Exemptions	TDPSA exempts state agencies, financial institutions subject to GLBA, covered entities and business associates under HIP...

Security

1 controls

Controls in the Security domain of Texas TDPSA — 1 controls
Code	Title	Description
TDPSA-541-101-SECURITY	Reasonable Security Practices	Controllers must establish, implement, and maintain reasonable administrative, technical, and physical data security pra...

Sensitive Data

2 controls

Controls in the Sensitive Data domain of Texas TDPSA — 2 controls
Code	Title	Description
TDPSA-541-101-BIOMETRIC	Biometric Data Handling (TDPSA and CUBI Overlap)	Biometric data is sensitive personal data under TDPSA, requiring opt-in consent. Texas Capture or Use of Biometric Ident...
TDPSA-541-101-GEO	Precise Geolocation Data	Precise geolocation data (radius of 1,750 feet or less) is sensitive personal data requiring opt-in consent before proce...

Transparency

2 controls

Controls in the Transparency domain of Texas TDPSA — 2 controls
Code	Title	Description
TDPSA-541-051-NOTICE	Privacy Notice Content Requirements	Controllers must provide a reasonably accessible and clear privacy notice that includes categories of personal data proc...
TDPSA-541-052	Sale of Sensitive Personal Data Notice	Controllers that sell sensitive personal data must post the exact notice: 'NOTICE: We may sell your sensitive personal d...

Vendor

3 controls

Controls in the Vendor domain of Texas TDPSA — 3 controls
Code	Title	Description
TDPSA-541-104-DPA	Controller-Processor Data Processing Agreement	Controllers must have a contract with processors that governs the processing, including instructions, nature/purpose, ty...
TDPSA-541-CONTRACTS-FLOW	Downstream Sale and Disclosure Contracts	Where personal data is sold or shared, the controller should bind recipients contractually to use limitations, security...
TDPSA-541-PROC-OBL	Processor Obligations and Cooperation	Processors must adhere to controller instructions, assist controllers in meeting obligations (security, breach response,...

Frequently Asked Questions

What is Texas TDPSA?

Texas TDPSA is a compliance framework from United States with 19 domains and 33 controls. Texas Data Privacy and Security Act (Tex. Bus. & Com. Code Ch 541, effective 1 Jul 2024). It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

How many controls does Texas TDPSA have?

Texas TDPSA has 33 controls organised across 19 domains. The largest domains are Consumer Rights (9 controls), Vendor (3 controls), Enforcement (2 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

What frameworks does Texas TDPSA map to?

Texas TDPSA does not currently have cross-framework mappings in our system. Check back as we continuously expand our mapping database.

How do I get started with Texas TDPSA compliance?

Start your Texas TDPSA compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about Texas TDPSA requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 33 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 769 frameworks.

Get Started Free →

Free forever — no credit card required