Texas law requires any business that holds certain personal information to protect it with reasonable procedures and, if it is breached, to notify affected individuals within 60 days of determining the breach occurred. If at least 250 Texas residents are involved, the business must also notify the Texas Attorney General within 30 days through an online form. A newer law, effective September 1, 2025, gives businesses with fewer than 250 employees some protection in lawsuits if they maintained a recognized cybersecurity program.
This guide is general information, not legal advice. Statutes change, and how they apply depends on your facts. Confirm your obligations with your attorney, and involve your insurer early if you ever have an incident.
Why it matters for a small firm
Most professional-services firms hold exactly the kind of information Texas protects: client Social Security numbers, bank and card details, driver's license numbers and sometimes health information. The law is not limited to large companies. The Attorney General can seek civil penalties of $2,000 to $50,000 per violation, with additional penalties for failing to notify people on time.
What counts as sensitive personal information
Texas Business and Commerce Code Chapter 521 defines sensitive personal information in two main ways:
Information lawfully made public by a government agency is excluded. Notice that encryption matters: the breach definition generally does not cover encrypted data unless whoever obtained it also has the key.
The duty to protect: reasonable procedures
Section 521.052 requires a business to implement and maintain reasonable procedures, including appropriate corrective action, to protect sensitive personal information from unlawful use or disclosure. It also requires destroying customer records containing that information when you will not keep them, by shredding, erasing or otherwise making them unreadable. The statute does not list specific technologies, so what is reasonable depends on your size, data and risks.
The duty to notify
The Attorney General's notice must describe the breach, the number of Texans affected, how many have been notified directly, what you have done and plan to do, and whether law enforcement is investigating. The Attorney General posts a public listing of reports it receives.
The 2025 safe harbor for smaller businesses
Senate Bill 2610, passed in 2025, added Chapter 542 to the Business and Commerce Code. It applies to business entities in Texas with fewer than 250 employees that own or license computerized data containing sensitive personal information. If such a business shows that, at the time of a breach, it had implemented and maintained a qualifying cybersecurity program, a person harmed by the breach cannot recover exemplary (punitive) damages from it. It does not block other damages, and it does not create a new right to sue. It applies to causes of action that accrue on or after September 1, 2025.
A qualifying program must include administrative, technical and physical safeguards, conform to a recognized framework, and be scaled to the business:
Listed frameworks include the NIST Cybersecurity Framework, NIST SP 800-171, NIST SP 800-53, the CIS Critical Security Controls, the ISO/IEC 27000 series, HITRUST, the Secure Controls Framework and SOC 2 Type 2, among others. Businesses subject to laws such as HIPAA or the Gramm-Leach-Bliley Act can conform to those. When a framework is updated, you generally have until the later of its stated implementation date or one year after publication to catch up. Ask your attorney how to document your program so you can show it existed at the time of an incident.
How Microsoft 365 supports reasonable procedures
No product makes you compliant on its own, but most small firms keep their sensitive data in Microsoft 365, so that is where many safeguards belong. Availability depends on your Microsoft 365 plan; check Microsoft's current documentation.
An incident-preparedness checklist
A scenario
Consider a hypothetical 25-person insurance agency. A staff member's mailbox is compromised and contains spreadsheets with client names and driver's license numbers for about 400 Texans. The agency would likely need to notify those individuals within 60 days and the Attorney General within 30 days of determining the breach occurred. Audit logs help establish what was accessed, and a documented program built on CIS Implementation Group 1 could matter if a lawsuit followed. Their attorney would make those calls.
How NexJen can help
We help Texas firms put practical safeguards in place in Microsoft 365: multi-factor sign-in, endpoint protection with managed detection and response (MDR), separate Microsoft 365 backup, and a documented security baseline. Our Security Posture and Compliance Assessment benchmarks your tenant against the CIS Benchmark and Microsoft Secure Score and gives you written findings your attorney can review. It is not a certification or a legal compliance opinion.
Common questions
Does the Texas breach law apply to my small business?
If you do business in Texas and own or license computerized sensitive personal information, the notification rules likely apply regardless of size. Confirm with your attorney.
Is the 30-day Attorney General deadline the same as the deadline for notifying people?
No. Individuals must be notified no later than 60 days after you determine the breach occurred; the Attorney General deadline is 30 days when 250 or more Texans are involved.
Does the 2025 safe harbor mean we cannot be sued?
No. It only limits exemplary damages for qualifying businesses with fewer than 250 employees. Other claims and damages remain possible.
Get help securing Microsoft 365
We can help you put practical safeguards in place in Microsoft 365 and document them, so your attorney has something concrete to review.