Licensing company data in Texas: what the TDPSA leaves out
Texas passed its privacy act in 2023 and wrote it for consumers, not for the records a business keeps about its own work. A person acting in a commercial or employment context is outside it, and a business that meets the federal small business definition has only a narrow duty. That makes Texas a lighter state for operating records, with three places where care is still needed.
Where Texas stands
The Attorney General publishes a page on the Texas Data Privacy and Security Act. The size test is the federal one, which looks at revenue or employees by industry, so the answer for a given company depends on its industry code.
| Question | Answer as of 2 November 2026 |
|---|---|
| Comprehensive privacy law | Yes. The Texas Data Privacy and Security Act, effective 1 July 2024. |
| Who it covers | Businesses that do business in Texas or sell products and services to Texans, process or sell personal data and are not small businesses as the Small Business Administration defines them. |
| Business and employee data | Outside it. The act leaves out individuals acting in a commercial or employment context. |
| Small businesses | Exempt, except that they must get consent before selling a consumer’s sensitive data. |
| Who enforces | The Attorney General. There is no private right of action. |
What the commercial context carve-out does
A support ticket from a customer’s employee writing about a company contract is a commercial context. So is a salesperson’s email to a prospect at another firm. Those records fall outside the act. A ticket from a consumer asking about a product they bought for themselves does not, so a Texas company with a retail side has a mixed archive and has to separate the two.
The carve-out is a statement about this one law. Federal rules, contract terms and the other states’ laws attach to the same records. A Texas company that serves California customers is still subject to California’s reach.
Two Texas laws outside the privacy act
| Law | Why it matters for a deal |
|---|---|
| Data broker registration (Business and Commerce Code chapter 509) | Texas requires data brokers, as the chapter defines them, to register with the Secretary of State every year. The Secretary of State says each business decides for itself whether the chapter applies. |
| Biometric identifiers (Business and Commerce Code 503.001) | A person may not capture a biometric identifier, which includes a voiceprint or a record of face geometry, for a commercial purpose without informing the individual and getting consent. A person who holds one may not sell, lease or otherwise disclose it except in four listed cases, and must destroy it within a year after the purpose for collecting it ends. The attorney general can seek a civil penalty for each violation. The legislature changed other Texas rules on artificial intelligence with effect from 1 January 2026, so read the current text of the section before relying on this summary. |
If a breach happens
Texas has its own breach law in Business and Commerce Code chapter 521, which sets notice duties to affected people and to the Attorney General for larger incidents. An archive of old records held by a closed company is as exposed as a live one.
Read next
- United States rules. The federal laws behind every state.
- Other states. What each state adds.
- De-identification. How personal detail comes out.
- Liability. Who answers for what in a deal.
Questions about licensing company data in Texas: what the TDPSA leaves out
Does the TDPSA apply to our employee records?
No. The act leaves out individuals acting in an employment context, so it is not the law that governs those records.
Are small Texas businesses free to sell sensitive data?
No. A small business still needs consent before selling a consumer’s sensitive data.
Does a Texas company with out-of-state customers follow only Texas law?
No. The law of the state where each person lives can apply to that person’s data.
Didn't find your question? Ask us directly.