Texas Data Breach Notification Law: Deadlines for Small Businesses (2026)

The core rule sits in Texas Business and Commerce Code Chapter 521. If a breach of system security exposes sensitive personal information, you must notify the affected individuals without unreasonable delay and no later than 60 days after you determine the breach occurred. Sensitive personal information generally means a person's name combined with an unencrypted Social Security number, driver's license number, or financial account number, along with certain health information.

Two points catch small businesses off guard:

• Attorney General notice: when a breach involves 250 or more Texas residents, you must also notify the Attorney General as soon as practicable and no later than 30 days after determining the breach occurred, using the electronic form the AG provides.
• Consumer reporting agencies: if more than 10,000 people are affected, you must also notify the major consumer reporting agencies.

Have counsel confirm the current text of the statute for your situation. This article is practical guidance, not legal advice.

The deadline runs from when you determine a breach occurred, not from when you finish investigating. Regulators and plaintiffs' attorneys read that closely. If your logs showed suspicious sign-ins three weeks before anyone looked at them, expect questions about what you knew and when.

That is why detection matters as much as notification. Businesses with centralized logging can establish a timeline in hours. Businesses without it spend weeks guessing. Our guide to log retention and SIEM data sources explains which logs to keep so you can answer the first question every investigator asks.

Most reportable incidents we see in Houston-area businesses start with a small, ordinary failure:

1. A stolen Microsoft 365 password or session token that gives an attacker access to mailboxes full of customer records.
2. A lost or stolen laptop or phone without disk encryption.
3. Ransomware that copies data out before it encrypts anything.
4. A vendor or business partner that is breached while holding your customers' data.
5. A staff member who emails a spreadsheet of sensitive records to the wrong recipient.

Encryption changes the analysis. Data that was properly encrypted, with the key not compromised, is generally outside the statute's definition of sensitive personal information. That is one reason device encryption and key management are compliance controls, not just security ones.

The Attorney General can seek civil penalties for failing to protect data and for failing to notify on time. Industry summaries of the statute describe per-violation penalties plus an additional daily amount per affected individual when notice is late, subject to a cap. Beyond fines, you face contract exposure with customers who require prompt notice, cyber insurance claim friction if you delay reporting, and reputational damage that lands hardest on a local firm that lives on referrals.

Your carrier will usually require notice of a claim quickly, and many policies include breach coach and forensics support that you can only use if you call early. Review the notice terms in our cyber insurance requirements guide before you need them.

A workable runbook is short enough to follow under stress. It should name who declares a breach, who calls counsel and your insurer, and who owns each outside deadline. Include:

• A decision log with timestamps for when each fact became known.
• A data map showing where sensitive records live, so you can scope who was affected.
• Draft notice letters and a template for the Attorney General submission.
• Evidence preservation steps so you do not destroy logs or devices. See our legal hold and data preservation guide.

Pair the runbook with a full incident response plan, and review how state privacy law overlaps in our Texas Data Privacy and Security Act overview. If you handle customer financial data, the FTC Safeguards Rule adds its own reporting duties.

This week, list every system that holds sensitive personal information and confirm two things for each: whether it is encrypted, and whether you can see who accessed it. Then write the one-page runbook above and name an owner for each deadline. If you want help, our IT compliance services can map your data and build the plan, and our cybersecurity services can close the detection gaps. You can also benchmark your readiness with the Texas SMB IT and cybersecurity benchmark.

• Houston managed IT
• Sugar Land managed IT
• The Woodlands managed IT