What is the data breach notification deadline in Texas?

Texas requires notice to affected individuals 60 calendar days from discovery (Tex. Bus. & Com. Code §§521.002, 521.053).

Do you have to notify the Texas Attorney General of a data breach?

Yes. Texas Attorney General must be notified.

← All jurisdictions

TX · data breach notification

Texas

high

Tex. Bus. & Com. Code §§521.002, 521.053

Individual deadline

60 days

Trigger standard

Any breach

AG / regulator

Required

Notice to individuals	60 calendar days from discovery
Risk-of-harm standard	None, notice required on any qualifying breach of covered personal information.
Encryption safe harbor	Yes, encrypted data (key not compromised) generally exempt.
Regulator notice	Texas Attorney General, required at 250+ residents; within 30 days Mandatory electronic Data Breach Reporting Form (cannot be saved — complete in one sitting) Six statutory content elements required (§521.053(i))
Credit reporting agencies	Notify CRAs above 10,000 residents.
Substitute notice	Typically available above $250,000 cost / 500,000 affected (verify).
Private right of action	No, enforcement by the state.
Penalties	$2,000–$50,000 per violation; up to $250,000 for failure to notify
Notable PI definitions	Includes medical, health insurance.

Rule last verified July 10, 2026 · confidence high. This is a reference summary, not legal advice; verify against the current statute. How we compile this →

Is a Texas breach part of a multi-state incident?

See every jurisdiction at once, with letters and filing packets generated.

Run the calculator →