Texas Data Privacy Act (TDPSA) Compliance
The Texas Data Privacy and Security Act took effect July 2024 — giving Texas consumers new rights over their personal data and giving the Texas Attorney General new enforcement authority with penalties up to $7,500 per violation.
What this covers
LayerLogix delivers practical TDPSA compliance for Houston businesses: applicability analysis, data mapping, privacy notice drafting, consumer rights request workflows, processor agreement negotiation, data protection assessments for high-risk processing, and reasonable security implementation.
We harmonize your TDPSA program with other state privacy laws so you are building one defensible privacy operation, not a patchwork.
Texas Data Privacy and Security Act · In practice
What a working TDPSA program looks like
Seven views, from the personal data you didn't know you held to requests answered on the clock and records you can show. It's how we walk Texas businesses through the TDPSA. Tap a lens or let it play.
The starting point · Personal data you hold
Your signup form is the tip. The rest sits below.
Your customer sees one form: name, email, maybe a phone number. Below the waterline that same person shows up in your CRM, the email list, order history, help desk tickets, a spreadsheet someone exported, vendor systems and backups. TDPSA work starts by finding all of it.
What LayerLogix does
- Inventory every category of personal data you collect
- Find the copies in exports, vendor systems and backups
- Flag sensitive data that needs consent before you use it
Step 1 · Applicability
Does TDPSA cover you? Run the three questions.
The law reaches businesses that operate in Texas or target Texans, process personal data and aren't a small business. That last test is the tricky one: it follows SBA size standards for your industry, so low revenue alone doesn't settle it. Pick a profile and watch it sort.
What LayerLogix does
- Run the applicability analysis against how you actually operate
- Check the SBA size standard for your industry instead of guessing
- Write up the call so you can defend it later
Step 2 · Data mapping
Give every data category a passport, stamped at each stop
A data map gives each category of personal data a passport and stamps it at every stop: where it came from, which system holds it, why you use it, who you share it with and when it's deleted. Your notice, request answers and assessments all read from it. Pick one.
What LayerLogix does
- Map sources, purposes, sharing and retention for each category
- Mark sensitive data and the uses that need an assessment
- Keep the map current as your systems and vendors change
Step 3 · Consumer rights requests
A request comes in. The 45-day clock starts.
Texas consumers can ask to see, correct, delete or get a portable copy of their data, and opt out of targeted ads, sales and certain profiling. You get 45 days to respond, and they can appeal if you say no. Each request runs one path: intake, verify, route, act, answer.
What LayerLogix does
- Set up the intake form and identity verification
- Route each request to whoever owns the data it touches
- Track the 45-day clock and keep a template for every answer
Step 4 · Opt-out signals and consent
Some opt-outs arrive as a browser signal, not an email
Starting in January 2025, browser signals like Global Privacy Control count as an opt-out of targeted ads and data sales. If your ad tags fire anyway, the opt-out wasn't honored. Sensitive data runs the other way: health, biometrics or precise location stay off until the person says yes.
What LayerLogix does
- Detect GPC signals across your websites and ad tags
- Hold targeted ads and data sales for visitors who opted out
- Put an affirmative consent step in front of sensitive data
Step 5 · Notice, DPAs and assessments
Three documents, built straight from your data map
The privacy notice tells consumers what you collect, why, who gets it and how to appeal. Processor agreements hold vendors to your purpose, to confidentiality and to the same terms for their subcontractors. Data protection assessments weigh benefits against risks for higher-risk uses.
What LayerLogix does
- Draft one privacy notice that also lines up with other state laws
- Review and negotiate processor agreements with your vendors
- Run and file data protection assessments for higher-risk uses
Step 6 · Reasonable security and evidence
Keep less, lock what stays, and keep the receipts
TDPSA expects reasonable security, and keeping less data makes that easier. Records past their retention date get deleted, what stays is encrypted and limited by role, and automated monitoring watches it. If something does go wrong, less is exposed. Flip the switch and compare.
What LayerLogix does
- Set retention rules and delete what you no longer need
- Encrypt personal data and limit access by role
- Keep request logs, notices, DPAs and assessments ready to show
Showing The starting point · Personal data you hold: Your signup form is the tip. The rest sits below.
What We Offer
Comprehensive solutions tailored for Houston-area businesses
TDPSA Applicability Analysis
Determine whether the Texas Data Privacy and Security Act actually applies to your business. TDPSA covers companies that conduct business in Texas or produce products targeted at Texas residents, process personal data, and are not a small business — but the small business carveout has nuances. We make the call defensibly.
Data Mapping and Inventory
Map every category of personal data your business collects, the sources, the purposes, the retention periods, and the third parties you share it with. Data mapping is the foundation of every other TDPSA requirement — privacy notices, consumer rights responses, and data protection assessments all depend on it.
Consumer Rights Request Workflows
Build the workflows to honor TDPSA consumer rights — access, correction, deletion, portability, and opt-out of targeted advertising, sale, and certain profiling. We deploy intake forms, identity verification, internal routing, response templates, and the 45-day clock tracking required by the statute.
Privacy Notice Drafting
Draft a TDPSA-compliant privacy notice covering the categories of personal data processed, the purposes, the categories shared with third parties, consumer rights, and the appeal process. We align it with other state privacy notices (CCPA, VCDPA, CPA) so you have one defensible document — not a patchwork.
Processor Agreements (DPAs)
Draft and negotiate Data Processing Agreements with vendors and service providers, as required when you act as a controller and they act as a processor under TDPSA. The statute spells out specific contract terms — purpose limitation, confidentiality, subcontractor flow-down — that we make sure are present.
Data Protection Assessments
Conduct the data protection assessments TDPSA requires for higher-risk processing — targeted advertising, sale of personal data, profiling that produces legal effects, and processing of sensitive data. We document the assessments, weigh benefits against risks, and keep them ready for the Texas Attorney General if requested.
Why Choose LayerLogix?
Serving businesses throughout the Greater Houston area including Houston, The Woodlands, Spring, Katy, Sugar Land, Conroe, Pearland, Dallas, Austin.
Avoid Texas AG Enforcement
TDPSA is enforced exclusively by the Texas Attorney General with civil penalties up to $7,500 per violation. The Texas AG has actively prioritized privacy enforcement and brought multi-million dollar actions under existing laws — TDPSA gives them new authority. Compliance now costs a fraction of an enforcement action later.
Build a Consumer Rights Engine That Actually Works
Honoring access, deletion, and opt-out requests is operationally hard — especially when data lives across CRMs, marketing tools, support platforms, and data warehouses. We build the workflows, automation, and accountability so requests get answered within the 45-day deadline without manual heroics every time.
Align With Other State Privacy Laws
TDPSA shares its DNA with Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), and Utah laws. Building one compliant program covers most of the United States privacy landscape. We design controls that scale across states so you are not rebuilding compliance every six months as new laws take effect.
Strengthen Customer Trust
Consumers increasingly expect transparency about how their data is used. A clear privacy notice, working consumer rights workflows, and visible data minimization differentiate you from competitors who treat privacy as a legal afterthought. Privacy is becoming a brand attribute, not just a regulatory burden.
Reduce Breach Impact
The data minimization, purpose limitation, and reasonable security requirements in TDPSA all reduce the volume and sensitivity of data exposed in a breach. Smaller breaches mean fewer notification obligations, lower legal exposure, and less reputational damage when something does go wrong.
Our Process
Frequently Asked Questions
When did the Texas Data Privacy and Security Act take effect?▼
Does TDPSA apply to small businesses?▼
What consumer rights does TDPSA grant?▼
How is TDPSA different from CCPA or VCDPA?▼
What is sensitive personal data under TDPSA?▼
Do we need to honor universal opt-out signals?▼
What penalties can the Texas AG impose?▼
Ready to Get Started?
Contact LayerLogix today for a free consultation. We serve businesses throughout Houston, The Woodlands, Spring, and the surrounding Greater Houston area.