Texas Business and Commerce Code Chapter 521: What It Requires

If your Texas business stores a customer's name, email address, driver's license number, or payment card data, you are already regulated by one of the state's most important privacy statutes. Texas Business and Commerce Code Chapter 521, often called the Texas Identity Theft Enforcement and Protection Act, sets the rules for how businesses must safeguard sensitive personal information, notify affected individuals when a breach occurs, and dispose of records once they are no longer needed. For contractors, shop owners, professional services firms, and growing companies, Chapter 521 is not a suggestion: it is a legal obligation with real financial penalties attached.

Understanding Chapter 521 matters because it touches nearly every part of your operation. Your hiring paperwork, your point-of-sale system, your client files, and even the old hard drives sitting in a storage closet all fall within its scope. This guide breaks down what the statute actually requires, who it applies to, and how Texas businesses can build practical compliance habits without hiring a full-time privacy officer.

What Is Texas Business and Commerce Code Chapter 521?

Chapter 521 is the Texas Identity Theft Enforcement and Protection Act. It was enacted to protect Texas residents from identity theft by placing duties on any person or business that collects, maintains, or handles personal identifying information. The statute defines personal identifying information broadly. It includes names in combination with identifiers such as Social Security numbers, driver's license numbers, government-issued identification numbers, account numbers, credit card numbers, and access codes or passwords.

The law operates through two main mechanisms. First, it establishes a duty to protect and safeguard personal identifying information. Second, it creates a duty to notify individuals when a breach of system security exposes their information. The Texas Attorney General enforces Chapter 521, and the statute authorizes civil penalties of up to $100 per individual per day for violations, capped at $250,000 per breach. Those numbers add up quickly when a single incident involves hundreds or thousands of records.

It is important to understand that Chapter 521 is not limited to large corporations. A five-person HVAC company, a family-owned restaurant, a boutique law firm, and a growing e-commerce shop all fall under the same basic obligations if they handle covered data. The statute focuses on conduct, not revenue size.

Who Must Comply With Chapter 521?

Chapter 521 applies to any person who conducts business in Texas and owns, licenses, or maintains personal identifying information. That language is deliberately broad. It covers sole proprietors, partnerships, LLCs, and corporations. It applies whether your business is based in Texas or simply serves Texas residents.

Consider a few common scenarios. A Dallas general contractor keeps employee I-9 forms and W-9s with Social Security numbers. A Houston restaurant stores customer loyalty program data with email addresses and phone numbers. An Austin consulting firm holds client tax records and bank account details. A San Antonio retail shop processes credit card payments through a point-of-sale terminal. Each of these businesses is subject to Chapter 521.

The statute also reaches vendors and service providers. If you outsource payroll, billing, or IT support, you remain responsible for ensuring that personal identifying information is protected. Contracts with third-party vendors should address data security, breach notification timelines, and indemnification. When a breach occurs at a vendor, your business may still bear the notification obligation to affected Texans.

The Core Requirements of Chapter 521

Chapter 521 imposes several distinct duties. They are not complicated in concept, but they require intentional implementation. The following list summarizes the main obligations that most Texas businesses need to address.

• Reasonable safeguards: Businesses must implement and maintain reasonable procedures to protect personal identifying information from unlawful use or disclosure.
• Breach notification: When a breach of system security occurs, affected individuals must be notified, generally within 60 days.
• Attorney General reporting: If a breach affects 250 or more Texas residents, the business must notify the Texas Attorney General within 30 days.
• Proper record disposal: Records containing personal identifying information must be destroyed or made unreadable before disposal.
• Employee training and policy: Businesses are expected to maintain policies and practices that support compliance with the statute.

These requirements work together. A business that shreds old files but never trains employees on phishing risks is only partially compliant. A business that has strong technical safeguards but no written breach response plan may struggle to meet the 60-day notification deadline. Compliance is a system, not a single action.

Breach Notification: The 60-Day Rule and What It Means

The most visible requirement under Chapter 521 is breach notification. When a breach of system security occurs, the business must notify any Texas resident whose personal identifying information was, or is reasonably believed to have been, acquired by an unauthorized person. Notice must be provided without unreasonable delay and no later than 60 days after the business determines that a breach occurred.

The notice itself must include specific elements. It should describe the incident in general terms, identify the type of information involved, provide contact information for the business, and explain what steps affected individuals can take to protect themselves. In many cases, the notice should also mention the right to obtain a security freeze and provide contact information for major credit reporting agencies.

If the breach affects 250 or more Texas residents, the business must also notify the Texas Attorney General. That notification must be submitted within 30 days of the determination that a breach occurred. The Attorney General's office maintains a portal for submitting these reports, and the information provided may be used for enforcement and public reporting purposes.

The clock starts when the business determines a breach has occurred, not when the incident is first suspected. Still, businesses should not delay investigation to push back the deadline. Regulators expect prompt, good-faith efforts to determine whether a breach happened and who was affected. Documenting your investigation timeline is one of the most important steps you can take to demonstrate compliance. For a closer look at how commercial auto exposures interact with broader business risk, see our guide on hired and non-owned auto coverage.

Reasonable Safeguards and Record Disposal

Chapter 521 requires businesses to implement and maintain reasonable procedures to protect personal identifying information. The statute does not prescribe a specific technology or checklist, but it does expect businesses to take the duty seriously. Reasonable safeguards typically include access controls, encryption of sensitive data, secure network configurations, employee training, and vendor oversight.

Record disposal is another explicit requirement. When a business disposes of records containing personal identifying information, it must destroy or arrange for the destruction of the records so that the information cannot be read or reconstructed. Acceptable methods include shredding, erasing, and other techniques that render the data unreadable. Simply throwing old files in a dumpster or recycling a computer without wiping the hard drive does not meet the standard.

Businesses should also think about where personal identifying information lives. It is not just in customer databases. It can be in email inboxes, paper files, backup tapes, mobile devices, and cloud accounts. A practical safeguard strategy identifies where the data is stored, who has access, and how it is protected at each stage of its lifecycle.

Penalties and Enforcement Under Chapter 521

The Texas Attorney General has authority to investigate and bring enforcement actions under Chapter 521. Civil penalties can reach $100 per individual per day for violations, with a cap of $250,000 per breach. The Attorney General may also seek injunctive relief and recover investigative costs and attorney's fees.

Beyond state penalties, businesses face other costs. Breach notification can be expensive, especially when it involves mailing notices, providing credit monitoring, and managing call center support. Reputational damage can be harder to quantify but equally serious. Customers, clients, and partners may hesitate to do business with a company that mishandles their data.

There is also the risk of private litigation. Although Chapter 521 does not create a private right of action, plaintiffs have pursued related claims under other theories, including negligence and breach of contract. A single incident can trigger multiple fronts of exposure, which is why a documented compliance program matters so much.

How Chapter 521 Connects to Your Business Insurance

Many Texas business owners assume their general liability policy will cover a data breach. In most cases, it will not. General liability policies typically exclude claims arising from the loss or disclosure of electronic data. That gap is one reason cyber liability insurance has become a core part of commercial coverage for Texas businesses.

Cyber liability policies can help cover breach notification costs, credit monitoring, forensic investigation, legal defense, and regulatory fines where insurable. For businesses that handle personal identifying information, cyber coverage is not a luxury; it is a practical complement to the compliance duties imposed by Chapter 521. Just as important, a cyber policy often provides access to breach response specialists who can help you meet the 60-day notification deadline.

Other policies may also play a role. Professional liability coverage can respond to claims that a business failed to protect client data in the course of providing services. Commercial property policies may cover physical records in some situations. Because every business handles data differently, a tailored review of your coverage stack is the best way to identify gaps.

Practical Steps to Comply With Chapter 521

Compliance does not require a massive budget, but it does require organization. The following framework can help Texas businesses build a workable program.

1. Inventory your data. Identify what personal identifying information you collect, where it is stored, and who can access it.
2. Adopt written policies. Create clear rules for handling, storing, transmitting, and disposing of personal identifying information.
3. Train your team. Teach employees how to recognize phishing, handle sensitive files, and report suspected incidents.
4. Implement safeguards. Use encryption, access controls, secure networks, and vendor agreements that address data security.
5. Build a breach response plan. Define who investigates, who notifies, and how you will meet the 60-day and 30-day deadlines.
6. Review insurance coverage. Confirm that your cyber liability and related policies match your actual data exposures.

Each of these steps supports the others. An inventory makes training more relevant. Training makes safeguards more effective. A response plan makes notification faster and more defensible. Insurance coverage helps absorb the financial shock when something goes wrong. For businesses that also operate vehicles, our article on hired and non-owned auto coverage for Texas businesses explains how another common exposure can be addressed through commercial auto coverage.

Common Mistakes Texas Businesses Make

One common mistake is assuming Chapter 521 only applies to businesses in technology or healthcare. In reality, the statute applies to any business that handles personal identifying information, which includes almost every industry. Contractors, restaurants, retail shops, and professional services firms all collect data.

Another mistake is treating compliance as a one-time project. Data flows change, employees turn over, and new systems are adopted. A policy written three years ago may not reflect how your business operates today. Regular reviews keep your program current.

A third mistake is overlooking vendors. If your payroll provider, billing service, or IT consultant suffers a breach, your customers' data may still be exposed. Vendor contracts should clearly address data security, notification obligations, and insurance requirements. A vendor that cannot demonstrate reasonable safeguards is a vendor that creates risk for your business.

Where to Get Help With Compliance and Coverage

Chapter 521 compliance involves legal, operational, and insurance considerations. Many Texas businesses benefit from working with advisors who understand the local landscape. An experienced insurance agency can help you evaluate whether your current policies address data breach exposures and whether additional coverage such as cyber liability makes sense for your operation.

Texas Policies works with contractors, shop owners, professional services firms, and growing companies across the state. The agency can review your commercial coverage, explain how policies respond to data-related claims, and help you request quotes from multiple carriers. If you are unsure whether your business is adequately protected, a coverage review is a practical first step.

Chapter 521 is not just a legal formality. It reflects the reality that personal information is valuable, and businesses that handle it are expected to protect it. By understanding what the statute requires, adopting reasonable safeguards, preparing for breach notification, and aligning your insurance coverage with your actual risks, your Texas business can meet its obligations and protect the people who trust you with their data.