Texas has had a data breach notification law for years, and it was tightened in 2019 and again in 2023. A lot of small businesses still haven't caught up, and the ones that get caught flat-footed are usually the small ones that never read the law to begin with. It applies to any business that holds personal information about customers, employees, or vendors.
If you're operating in La Porte, Pasadena, or anywhere along the Houston Ship Channel where chemical, industrial, and professional-services firms cluster, here's what you need to know.
What the Texas law covers
The rules are in Chapter 521 of the Texas Business & Commerce Code (the Identity Theft Enforcement and Protection Act). A breach notice is triggered when someone's name is exposed together with things like a Social Security number, a driver's license or government ID number, or a financial account or card number with the code that unlocks it. Health information is covered too.
Two changes shape today's rules:
- 2019: a firm 60-day deadline to notify affected individuals (in effect since January 1, 2020), and a requirement to notify the Texas Attorney General when 250 or more Texans are affected.
- 2023: the notice to the Attorney General got its own, shorter deadline of 30 days, filed through the AG's online form.
The federal layer still applies on top: HIPAA for health care, the FTC Safeguards Rule for non-bank financial businesses, SEC rules for public companies, and so on.
Who has to notify whom, and when
Under Section 521.053, if a breach affects Texas residents:
- Individuals: without unreasonable delay, and no later than 60 days after you determine that a breach occurred.
- Texas Attorney General: if 250 or more Texas residents are affected, as soon as practicable and no later than 30 days after you determine the breach occurred, using the AG's online form.
- National credit bureaus: if you have to notify more than 10,000 people at one time.
- Federal regulators: depending on your sector. For example, HHS for health care, and the FTC if you're a non-bank financial business (breaches affecting 500 or more people, within 30 days).
Late notice is expensive. On top of other civil penalties, Texas law allows up to $100 per affected person for each day notice is late, up to $250,000 for a single breach.
If your business works for energy operators or other large customers, your contracts may require you to tell them much sooner, sometimes within 24 hours. Check your vendor agreements.
Your first 72 hours
Texas doesn't have a 72-hour legal deadline, but planning your first three days is the best way to meet the deadlines it does have. You discover something at 9am on Monday. What happens next?
- Hour 0 to 4: contain. Isolate affected systems. Don't power them down (that destroys forensic evidence); disconnect them from the network.
- Hour 4 to 12: assemble the team. Owner, IT, legal counsel, cyber insurer, possibly outside forensics.
- Hour 12 to 24: scope. What systems? What data? How many records? Whose data, and in which states do they live?
- Hour 24 to 48: notify your insurer and any customers your contracts require you to tell. Start drafting individual notifications.
- Hour 48 to 72: legal review. Keep in mind the 60-day and 30-day clocks may already be running, since they start when you determine a breach occurred.
If you don't have a written incident response plan with names and phone numbers, you'll burn the first 24 hours just figuring out who to call.
A 5-step response template
- Detect and contain. Isolate. Preserve evidence. Don't try to "clean it up" before the forensics team sees it.
- Assess. What data was potentially exposed? Whose? Where do those people live?
- Notify partners. Insurance carrier first. Then any customers or operators your contracts require you to tell. Then law enforcement if appropriate.
- Notify individuals and regulators. Within the legal deadlines, with the language your attorney approves.
- Remediate and document. Close the vulnerability. Document everything. Update the incident response plan based on what you learned.
A reason to have a written security program
A Texas law passed in 2025 (SB 2610, effective September 1, 2025) gives businesses with fewer than 250 employees some protection from punitive damages in a breach lawsuit, if they keep a documented cybersecurity program based on a recognized framework. Having the program, and being able to show it, now matters in court as well as in an insurance claim.
What La Porte and Pasadena businesses should do now
Before any breach happens:
- Map what personal information you actually hold, where it lives, and who has access.
- Write the incident response plan. Names, phone numbers, escalation order.
- Verify your cyber insurance covers breach response, not just data loss.
- Put basic controls in place that make a breach less likely: multi-factor authentication, endpoint protection, email filtering, and backups.
- Train every employee on what to do if they see something suspicious. The first hour matters.
If any of these are gaps, we help La Porte and Pasadena small businesses close them, without enterprise pricing. Book a free discovery call and we'll walk through where you stand.
This is general information, not legal advice. Talk to your attorney about your specific situation.
Aspendora Technologies is a La Porte-based managed IT services and cybersecurity partner for Houston-area small businesses, founded in 2010.