Timing of Consumer Notification
“As quickly as possible.”
Method of Notice
Mail. Email permitted if complies with E-SIGN.
Breach Definition
Unauthorized acquisition of computerized data that compromises security, confidentiality, or integrity of sensitive personal information maintained by person, including data that is encrypted if person accessing data has key to decrypt.
PII Definition
Individual’s first name or first initial and last name in combination with any of these if not encrypted:
  1. Social Security number;
  2. Driver’s license number or government-issued identification number; or
  3. Account number or credit or debit card number in combination with required security code, access code, or password that would permit access to individual’s financial account; or
  4. Information that identifies individual and relates to:
    1. Physical or mental health or condition of individual;
    2. Provision of health care to individual; or
    3. Payment for provision of health care to individual. 
Third Party Notice
If data collector maintains covered information for someone else, it must notify them following discovery of breach.
How to Notify
No content requirement.
Substitute Notice
Any of these: (a) email, if person has email addresses for affected persons; (b) conspicuous posting of notice on person's website; or (c) notice published in or broadcast on major statewide media.
Credit Monitoring
Not required.
When to Notify Credit Agencies
If more than 10,000 Texas residents must be notified.
This State's Law
State Government Agency Notification Required