Running a business in League City just got a bit more complex. You now need to think about how you collect and use customer information.
The Texas Data Privacy and Security Act changed the rules. And if you handle customer data, you need to know what this means for your business.
What Is the Texas Data Privacy and Security Act?
Understanding TDPSA’s Purpose and Background
The Texas Data Privacy and Security Act, or TDPSA, is a new law that protects how businesses handle customer information in Texas.
Governor Greg Abbott signed it into law on June 18, 2023. Most parts started working on July 1, 2024.
Think of it this way. When someone shops at your League City store or uses your website, they share information with you. Maybe their name, email, or where they live. TDPSA says you need to protect that information and use it the right way.
Texas became the tenth state to create this type of law. California did it first. Now, Texas, being the second-largest state, joined them.
According to the Texas Attorney General’s office, this law gives Texas residents more control over their personal information. It also makes businesses more responsible for protecting customer data.
Key Effective Dates Every Business Should Know
Most of TDPSA became active on July 1, 2024.
But there’s one part that started later. On January 1, 2025, businesses had to start honoring something called “universal opt-out mechanisms.” This means customers can use tools like Global Privacy Control to say “no” to data sales across many websites at once.
If you’re reading this now, both dates have passed. Your business should already be following these rules.
I know what you’re thinking. “Another regulation to worry about?” Well, the good news is many League City businesses might not need to follow all these rules. Let me explain.
Does TDPSA Apply to Your League City Business?
The Small Business Exemption Explained
Here’s something unique about Texas law. Small businesses get a break.
If your business meets the Small Business Administration’s definition of a small business, you’re mostly exempt from TDPSA. The SBA usually considers a business “small” if it has fewer than 500 employees. But this can change based on your industry.
For instance, a manufacturing company might have different limits than a retail store. You can check the SBA’s website to see where your business fits.
I remember talking to a League City restaurant owner last year. She was worried about TDPSA. When I told her about the small business exemption, she felt relief. Her team of 15 people meant she didn’t have to follow most rules.
But wait. There’s one big exception.
Even if you’re a small business, you cannot sell sensitive customer data without getting their permission first. We’ll talk more about sensitive data in a moment.
When League City Businesses Must Comply
Your League City business needs to follow TDPSA if you check all these boxes:
You do business in Texas or sell products or services to Texas residents. You process or sell personal data. You’re not a small business according to SBA standards.
Notice something? There’s no money limit here. California’s law only applies to businesses making over $25 million yearly. Texas doesn’t care about your revenue. If you’re not a small business and you handle customer data, these rules apply to you.
Some businesses don’t need to comply at all. According to TDPSA, these include:
- State government offices
- Nonprofits
- Banks and financial institutions covered by other federal laws
- Healthcare providers already follow HIPAA rules
- Colleges and universities
Most League City businesses fall into normal retail, service, or professional categories. If that’s you, keep reading.
Understanding Personal Data Under Texas Law
What Counts as Personal Data?
Personal data means any information that connects to a specific person.
This includes obvious things like names, addresses, and phone numbers. But it also includes less obvious things like:
- IP addresses
- Cookies on your website
- Shopping history
- Location information
Basically, if you can link information back to one person, it’s personal data.
What doesn’t count? Information that’s already public. If someone posts their business address on a public website, that’s not protected. Also, information that can’t be linked to anyone specific doesn’t count.
The Special Rules for Sensitive Data
Some personal data is extra sensitive. Texas law calls this sensitive data.
This includes information about:
- Someone’s race or ethnicity
- Religious beliefs
- Health conditions or medical diagnoses
- Sexual orientation
- Citizenship or immigration status
- Genetic information
- Biometric data like fingerprints or face scans
- Exact location tracking
- Any data from children under 13
If you collect this type of information, you need the customer’s clear permission before using it.
Let me give you an example. Say you run a fitness center in League City. You collect health information from members. Under TDPSA, you need to tell people exactly how you’ll use that health data. And you need their “yes” before you can use it.
Even small businesses need to follow this rule if they sell sensitive data.
Consumer Rights Your Business Must Honor
Access, Correction, and Deletion Rights
Texas residents now have specific rights over their data.
They can ask you:
“Do you have my personal data?” You need to confirm yes or no.
“What data do you have about me?” You need to show them.
“My address is wrong in your system.” You need to fix it.
“Delete my information.” You need to remove it (with some exceptions).
“Give me a copy of my data.” You need to provide it in a format they can use.
When someone makes a request, you have 45 days to respond. You can extend this another 45 days if needed, but you must tell the person why.
The first two requests each year must be free. If someone asks more than that, you can charge a reasonable fee.
I’ve seen businesses struggle with this. One League City shop owner told me a customer asked for all their data. The owner had information spread across three different systems. It took hours to gather everything.
That’s why having organized records matters. We’ll talk about that later.
The Opt-Out Requirements You Can’t Ignore
Customers can tell you to stop doing certain things with their data:
- Stop selling it to other companies
- Stop using it for targeted ads
- Stop using it for automated decisions that affect them legally
You need to make opting out easy. No making people jump through hoops. No sneaky buttons or confusing language. The law bans what it calls “dark patterns” – tricks that confuse people into agreeing to things.
Starting January 2025, you also need to honor universal opt-out signals. If someone uses Global Privacy Control in their browser, you need to respect that choice automatically.
Your Compliance Responsibilities as a League City Business Owner
Data Collection and Processing Rules
You can only collect data you actually need.
The law says you must limit collection to what is “adequate, relevant, and reasonably necessary” for your stated purpose.
Let’s say you run an online store in League City. You need a customer’s shipping address to send products. That’s necessary. But you probably don’t need to know their exact GPS location or their mother’s maiden name.
If you want to collect extra information, you need to get permission first.
Also, you need to tell customers what you’re collecting and why. This goes in your privacy notice, which we’ll cover next.
Security Measures You Must Implement
You must protect the data you collect.
The law requires “reasonable administrative, technical, and physical data security practices.” This is intentionally flexible because security needs differ by business size and type.
For most League City businesses, this means:
Administrative: Have written policies about data security. Train your employees. Know who can access what data.
Technical: Use passwords. Update your software. Encrypt sensitive information if you store it digitally.
Physical: Lock file cabinets with paper records. Control who can enter rooms with computers or files.
According to the Texas Attorney General, businesses must take these protections seriously. Recent enforcement actions show they’re watching.
Think about it from a customer’s view. If they give you their information, they trust you to keep it safe. That trust is worth protecting.
Privacy Notices and Transparency Requirements
What Your Privacy Notice Must Include
You need a clear privacy notice on your website or in your store.
This notice must explain:
- What personal data do you collect
- Why do you collect it
- How you use it
- Who you share it with
- How long do you keep it
- How customers can make requests about their data
Write it in plain English. Avoid legal jargon when possible. The point is that regular people can understand it.
I’ve noticed many businesses copy privacy policies from templates online. That’s okay as a starting point. But make sure you update it to match what you actually do. Don’t say you only collect emails if you’re also collecting phone numbers and addresses.
Special Disclosure Rules for Sensitive Data Sales
- If you sell sensitive personal data, you need a special warning.
- Your privacy notice must include this exact text: “NOTICE: We may sell your sensitive personal data.”
- If you sell biometric data specifically, it must say: “NOTICE: We may sell your biometric personal data.”
- These warnings need to be obvious. Put them in the same place as your main privacy notice.
Most League City businesses don’t sell customer data at all. If that’s you, you don’t need these special notices. But if you’re not sure whether something counts as “selling,” talk to a lawyer. The definition is broader than you might think.
Working with Vendors and Data Processors
Contract Requirements Under TDPSA
If you hire companies to handle customer data for you, you need proper contracts.
These contracts must include:
- Clear instructions on how they can use the data
- What type of data are they handling
- How long can they keep it
- Their duty is to keep it confidential
- Agreement to delete or return data when done
- Their willingness to cooperate with audits
For example, say you use a company to send email newsletters to your League City customers. That company is a “data processor.” You’re the “data controller.”
Your contract with them needs to spell out exactly what they can and can’t do with customer email addresses.
Managing Third-Party Relationships
You’re responsible for your vendors’ actions with customer data.
If your email company sells customer information to spammers, you could face penalties. Even though you didn’t do it directly, you’re still on the hook.
This means you need to:
- Choose vendors carefully
- Check their security practices
- Include TDPSA requirements in contracts
- Monitor what they’re doing
- Have backup plans if they mess up
I know a League City business that learned this the hard way. They used a cheap marketing service. That service had poor security. Customer emails got leaked. The business owner felt terrible and had to notify everyone affected.
Good vendors understand privacy laws. They’ll work with you on compliant contracts. If a vendor refuses to sign proper agreements, that’s a red flag.
Enforcement and Penalties: What’s at Stake
How the Texas Attorney General Enforces TDPSA
Only the Texas Attorney General can enforce TDPSA.
Customers can’t sue you directly for violations. But they can report you to the Attorney General’s office.
The AG has been taking this seriously. In December 2024, according to reports from multiple news sources, Attorney General Ken Paxton launched investigations into companies like Character.AI, Reddit, Instagram, and Discord. He’s checking if they’re protecting children’s data properly.
The AG can:
- Investigate complaints
- Demand documents and assessments from your business
- Require you to fix violations
- Seek court orders to stop violations
- Impose financial penalties
Understanding the 30-Day Cure Period
Here’s some good news. You get a chance to fix problems before facing penalties.
If the Attorney General thinks you violated TDPSA, they must send you a notice. You then have 30 days to fix the issue.
This “cure period” never goes away. Even years from now, you’ll still get 30 days to correct violations before penalties apply.
To take advantage of this, you need to:
- Fix the actual problem
- Send written proof to the Attorney General showing what you did
- Do it all within 30 days
If you don’t fix it or if you ignore the notice, penalties start.
The fine is up to $7,500 per violation. And here’s the tricky part – each instance can count as a separate violation.
Imagine you improperly collected data from 100 customers. That could be 100 violations. The math gets scary fast.
But honestly, most League City businesses won’t face these penalties if they make good faith efforts to comply. The AG focuses on companies that ignore the law or harm many people.
Step-by-Step Compliance Roadmap for League City Businesses
Conducting Your Initial Gap Assessment
Start by figuring out where you stand now.
Step 1: List all the personal data you collect. Don’t skip anything. Include information from:
- Online forms
- Email sign-ups
- Purchase records
- Customer accounts
- In-store sign-ups
- Social media
- Cookies on your website
Step 2: Figure out why you collect each type of data. Can you justify it? Do you actually use it?
Step 3: Check how you store this data. Is it on computers? In file cabinets? In the cloud? Who can access it?
Step 4: Look at your current privacy policy. Does it accurately describe what you do? If you don’t have one, you need to create it.
Step 5: Review your vendor contracts. Do they meet TDPSA requirements?
Step 6: Test your process for handling customer requests. Can you actually find and provide someone’s data if they ask? Can you delete it?
This assessment might take a few hours or a few days, depending on your business size. Don’t rush it. Understanding your current situation is the foundation for everything else.
Building Your Ongoing Compliance Program
After your assessment, fix the gaps you found.
Create or update your privacy notice. Make it clear and accessible. Post it on your website. Have copies in your store if needed.
Set up a system for customer requests. Decide who handles these requests. Train them. Create forms or email addresses for people to use.
Improve your security. Fix any obvious problems. Update passwords. Lock file cabinets. Limit who can access sensitive information.
Clean up your data collection. Stop collecting information you don’t need. Delete old customer data you no longer use.
Fix vendor contracts. Update agreements to include TDPSA requirements. Switch vendors if needed.
Train your team. Make sure employees understand the basics. They should know not to share customer information carelessly.
Document everything. Keep records of what you did to comply. If the Attorney General asks questions, you’ll have proof of your good faith efforts.
Review regularly. Privacy laws keep changing. Check your compliance every six months or at least yearly.
For a study published by multiple privacy compliance firms, businesses that take these steps early avoid most problems. It’s not about being perfect. It’s about showing you care and you’re trying.
Conclusion
The Texas Data Privacy and Security Act brings new responsibilities for League City businesses. But it doesn’t have to be overwhelming.
Start with understanding if the law applies to your business. Many small businesses have limited obligations.
If you do need to comply, take it step by step. Assess where you are now. Fix the obvious gaps. Create clear privacy notices. Set up systems for customer requests. Protect the data you have.
Most importantly, remember why this matters. Your customers trust you with their information. TDPSA helps you honor that trust. Good data practices aren’t just about avoiding penalties. They’re about running a better, more trustworthy business.
League City’s economy is growing. New businesses are coming here. As our community grows, protecting customer privacy will become even more important. Getting ahead of these requirements now puts you in a stronger position for the future.
If you feel stuck, don’t hesitate to ask for help. Talk to other business owners. Reach out to local business groups. Consider consulting with a privacy lawyer for complex questions.
You’ve got this. One step at a time, you can build a compliance program that protects your customers and your business.
Frequently Asked Questions
Does TDPSA apply to all businesses in League City?
No, not all businesses. If you meet the Small Business Administration’s definition of a small business, you’re mostly exempt. Generally, this means having fewer than 500 employees, though it varies by industry. However, even small businesses cannot sell sensitive personal data without customer consent. Also, some businesses like nonprofits, healthcare providers following HIPAA, and government agencies are completely exempt regardless of size.
What happens if my business violates TDPSA?
The Texas Attorney General will first send you a notice giving you 30 days to fix the problem. If you correct the violation and prove it to the AG within those 30 days, you won’t face penalties. If you don’t fix it or ignore the notice, you can be fined up to $7,500 per violation. Each separate incident counts as its own violation, so penalties can add up quickly. The AG can also seek court orders to stop you from violating the law.
Do I need to hire a lawyer to comply with TDPSA?
Most League City businesses can handle basic compliance themselves, especially if you’re doing straightforward retail or services. Start with the gap assessment and basic steps outlined in this guide. However, you should consider legal help if you collect large amounts of customer data, sell data to third parties, handle very sensitive information, or have complex business operations. A lawyer can review your specific situation and help with contracts and policies.
How is TDPSA different from other state privacy laws?
TDPSA is unique because it exempts small businesses entirely, unlike California or Colorado, which use revenue thresholds. Texas doesn’t have minimum revenue or customer number requirements – if you’re not a small business and handle Texas customer data, you’re covered. The 30-day cure period never expires, which is better than some state,s where it ends after a few years. However, TDPSA doesn’t allow customers to sue you directly – only the Attorney General can enforce it.
What should I do if I receive a consumer data request?
First, verify the person’s identity to make sure they’re actually the customer. Then, you have 45 days to respond to most requests. You can extend this another 45 days if you notify the customer why you need more time. For access requests, gather all the personal data you have about them. For deletion requests, remove their data from your systems unless you have a legal reason to keep it. For correction requests, fix any inaccuracies. Provide the first two requests per year for free. Keep records of all requests and your responses.
