Texas Business & Commerce Code
§ 521.053 — NOTIFICATION REQUIRED FOLLOWING BREACH OF SECURITY OF COMPUTERIZED DATA
BC § 521.053Title 11. PERSONAL IDENTITY INFORMATION · Part B. IDENTITY THEFT · Ch. 521. UNAUTHORIZED USE OF IDENTIFYING INFORMATION · Art. B. IDENTITY THEFT
Statute text
View on source(a)In this section, "breach of system security" means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of sensitive personal information maintained by a person, including data that is encrypted if the person accessing the data has the key required to decrypt the data. Good faith acquisition of sensitive personal information by an employee or agent of the person for the purposes of the person is not a breach of system security unless the person uses or discloses the sensitive personal information in an unauthorized manner.
(b)A person who conducts business in this state and owns or licenses computerized data that includes sensitive personal information shall disclose any breach of system security, after discovering or receiving notification of the breach, to any individual whose sensitive personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure shall be made without unreasonable delay and in each case not later than the 60th day after the date on which the person determines that the breach occurred, except as provided by Subsection (d) or as necessary to determine the scope of the breach and restore the reasonable integrity of the data system. (b-1) If the individual whose sensitive personal information was or is reasonably believed to have been acquired by an unauthorized person is a resident of a state that requires a person described by Subsection (b) to provide notice of a breach of system security, the notice of the breach of system security required under Subsection (b) may be provided under that state's law or under Subsection (b).
(c)Any person who maintains computerized data that includes sensitive personal information not owned by the person shall notify the owner or license holder of the information of any breach of system security immediately after discovering the breach, if the sensitive personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
(d)A person may delay providing notice as required by Subsection (b) or (c) at the request of a law enforcement agency that determines that the notification will impede a criminal investigation. The notification shall be made as soon as the law enforcement agency determines that the notification will not compromise the investigation.
(e)A person may give notice as required by Subsection (b) or (c) by providing:
(1)written notice at the last known address of the individual;
…
Legislative history
Acts 2009, 81st Leg., R.S., Ch. 419 (H.B. 2004), Sec. 3, eff. September 1, 2009. Acts 2011, 82nd Leg., R.S., Ch. 1126 (H.B. 300), Sec. 14, eff. September 1, 2012. Acts 2013, 83rd Leg., R.S., Ch. 1368 (S.B. 1610), Sec. 1, eff. June 14, 2013. Acts 2019, 86th Leg., R.S., Ch. 1326 (H.B. 4390), Sec. 1, eff. January 1, 2020. Acts 2021, 87th Leg., R.S., Ch. 496 (H.B. 3746), Sec. 1, eff. September 1, 2021. Acts 2023, 88th Leg., R.S., Ch. 246 (S.B. 768), Sec. 1, eff. September 1, 2023.