🇺🇸 US-Texas

Informations

Extracts :

Extract :

There is no information on this based on HB 4 official text.

2023

Reference :

HB 4

Information on Texas data protection regulations

Link to reference

Extracts :

Extract :

"The Texas law would apply to all businesses that (1) conduct business in Texas (or produce goods or services consumed in Texas) and (2) process or sell personal data (both of which are defined broadly)."

2023

Reference :

Texas May Soon Have One of the Strongest Data Privacy Laws in the U.S.

Features of HB 4 Texas | BakerBotts

Link to reference

Extracts :

Extract :

Extracts :

Extract :

""Processor" means a person that processes personal data on behalf of a controller."

2023

Reference :

HB 4

Information on Texas data protection regulations

Link to reference

Extracts :

Extract :

There is no information on this based on HB 4 official text.

2023

Reference :

HB 4

Information on Texas data protection regulations

Link to reference

Extracts :

Extract :

2023

Reference :

Texas May Soon Have One of the Strongest Data Privacy Laws in the U.S.

Features of HB 4 Texas | BakerBotts

Link to reference

Extracts :

Extract :

2023

Reference :

Texas May Soon Have One of the Strongest Data Privacy Laws in the U.S.

Baker Botts

Link to reference

Extracts :

Extract :

"Sensitive Data – Consent is required before processing sensitive data, which includes personal data revealing racial or ethnic origin, religious beliefs, mental or physical health diagnosis, citizenship or immigration status, genetic or biometric data processed for purposes of uniquely identifying an individual; personal data collected from a known child under 13, and precise geolocation data. The Senate version of the bill excludes data revealing “sexual orientation” from the categories of sensitive information, which differs from all other state privacy laws. "

2023

Reference :

Texas May Soon Have One of the Strongest Data Privacy Laws in the U.S.

Baker Botts

Link to reference

Extracts :

Extract :

2023

Reference :

Texas May Soon Have One of the Strongest Data Privacy Laws in the U.S.

Baker Botts

Link to reference

Extracts :

Extract :

2023

Reference :

Texas May Soon Have One of the Strongest Data Privacy Laws in the U.S.

Baker Botts

Link to reference

Extracts :

Extract :

2023

Reference :

Texas May Soon Have One of the Strongest Data Privacy Laws in the U.S.

Baker Botts

Link to reference

Extracts :

Extract :

2023

Reference :

Texas May Soon Have One of the Strongest Data Privacy Laws in the U.S.

Baker Botts

Link to reference

Extracts :

Extract :

Data entered based on reference.

2023

Reference :

Texas Data protection overview | DataGuidance

Information on Texas data protection | DataGuidance

Link to reference

Extracts :

Extract :

Data entered based on reference.

2023

Reference :

Texas Data protection overview | DataGuidance

Information on Texas data protection | DataGuidance

Link to reference

Extracts :

Extract :

Data entered based on reference.

2023

Reference :

Texas Data protection overview | DataGuidance

Information on Texas data protection | DataGuidance

Link to reference

Extracts :

Extract :

Data entered based on reference.

2023

Reference :

Texas Data protection overview | DataGuidance

Information on Texas data protection | DataGuidance

Link to reference

Extracts :

Extract :

2023

Reference :

Texas May Soon Have One of the Strongest Data Privacy Laws in the U.S.

Baker Botts

Link to reference

Extracts :

Extract :

Data entered based on reference.

2023

Reference :

Texas Data protection overview | DataGuidance

Information on Texas data protection | DataGuidance

Link to reference

Extracts :

Extract :

Data entered based on reference.

2023

Reference :

Texas Data protection overview | DataGuidance

Information on Texas data protection | DataGuidance

Link to reference

Extracts :

Extract :

Data entered based on reference.

2023

Reference :

Texas Data protection overview | DataGuidance

Information on Texas data protection | DataGuidance

Link to reference

Extracts :

Extract :

Data entered based on reference.

2023

Reference :

Texas Data protection overview | DataGuidance

Information on Texas data protection | DataGuidance

Link to reference

Extracts :

Extract :

Data entered based on reference.

2023

Reference :

Texas Data protection overview | DataGuidance

Information on Texas data protection | DataGuidance

Link to reference

Extracts :

Extract :

Data entered based on reference.

2023

Reference :

Texas Data protection overview | DataGuidance

Information on Texas data protection | DataGuidance

Link to reference

Extracts :

Extract :

Data entered based on reference.

2023

Reference :

Texas Data protection overview | DataGuidance

Information on Texas data protection | DataGuidance

Link to reference

Extracts :

Extract :

"A person who violates this chapter following the cure period described by Section 541.154 or who breaches a written statement provided to the attorney general under that section is liable for a civil penalty in an amount not to exceed $7,500 for each violation."

2023

Reference :

HB 4

Information on Texas data protection regulations

Link to reference

Extracts :

Extract :

Extracts :

Extract :

There is no information on this in HB 4.

2023

Reference :

HB 4

Information on Texas data protection regulations

Link to reference

Extracts :

Extract :

There is no information on this in HB 4.

2023

Reference :

HB 4

Information on Texas data protection regulations

Link to reference

Extracts :

Extract :

"The law does not include a private right of action. "

2023

Reference :

Texas May Soon Have One of the Strongest Data Privacy Laws in the U.S.

Features of HB 4 Texas | BakerBotts

Link to reference

Extracts :

Extract :

"The law does not include a private right of action. "

2023

Reference :

Texas May Soon Have One of the Strongest Data Privacy Laws in the U.S.

Features of HB 4 Texas | BakerBotts

Link to reference

Extracts :

Extract :

"The law does not include a private right of action. "

2023

Reference :

Texas May Soon Have One of the Strongest Data Privacy Laws in the U.S.

Features of HB 4 Texas | BakerBotts

Link to reference

Extracts :

Extract :

"The attorney general shall post on the attorney general’s Internet website: (1) information relating to: (A) the responsibilities of a controller under Subchapters B and C; (B) the responsibilities of a processor under Subchapter C; and (C) a consumer’s rights under Subchapter B; and (2) an online mechanism through which a consumer may submit a complaint under this chapter to the attorney general."

2023

Reference :

HB 4

Information on Texas data protection regulations

Link to reference

Extracts :

Extract :

There is no information on this in HB 4.

2023

Reference :

HB 4

Information on Texas data protection regulations

Link to reference

Extracts :

Extract :

Extracts :

Extract :

"A controller shall conduct and document a data protection assessment of each of the following processing activities involving personal data: (1) the processing of personal data for purposes of targeted advertising; (2) the sale of personal data; (3) the processing of personal data for purposes of profiling, if the profiling presents a reasonably foreseeable risk of: (A) unfair or deceptive treatment of or unlawful disparate impact on consumers; (B) financial, physical, or reputational injury to consumers; (C) a physical or other intrusion on the solitude or seclusion, or the private affairs or concerns, of consumers, if the intrusion would be offensive to a reasonable person; or (D) other substantial injury to consumers; (4) the processing of sensitive data; and (5) any processing activities involving personal data that present a heightened risk of harm to consumers."

2023

Reference :

HB 4

Information on Texas data protection regulations

Link to reference

Extracts :

Extract :

"Research with personal information that may have been collected from a consumer in the course of the consumer ’s interactions with a business’s service or device for other purposes must be: (1) compatible with the business purpose for which the personal information was collected; (2) subsequently pseudonymized and deidentified, or deidentified and in the aggregate, such that the information cannot reasonably identify, relate to, describe, be capable of being associated with, or be linked, directly or indirectly, to a particular consumer;"

2020

Reference :

HB 4518 (DEAD BILL)

Information on Texas data protection regulations

Link to reference

Extracts :

Extract :

Based on ref 684, "entity" is a data handler in the spirit of the Data Controller in the GDPR. Therefore, there are obligations for reporting data breaches of this nature.

2021

Reference :

SECURITY BREACH NOTIFICATION CHART - Texas

Information on Texas data breach notification requirements

Link to reference

Extracts :

Extract :

Based on ref 684, "entity" is a data handler in the spirit of the Data Controller in the GDPR. Therefore, there are obligations for reporting data breaches of this nature.

2021

Reference :

SECURITY BREACH NOTIFICATION CHART - Texas

Information on Texas data breach notification requirements

Link to reference

Extracts :

Extract :

" A processor shall adhere to the instructions of a controller and shall assist the controller in meeting or complying with the controller's duties or requirements under this chapter, including: assisting the controller with regard to complying with the requirement relating to the security of processing personal data and to the notification of a breach of security of the processor's system under Chapter 521, taking into account the nature of processing and the information available to the processor;"

2023

Reference :

HB 4

Information on Texas data protection regulations

Link to reference

Extracts :

Extract :

Based on ref 651, there is no information of notification duties/obligations of the data processor.

2023

Reference :

HB 4

Information on Texas data protection regulations

Link to reference

Extracts :

Extract :

Based on ref 651, there is no information of notification duties/obligations of the data processor.

2023

Reference :

HB 4

Information on Texas data protection regulations

Link to reference

Extracts :

Extract :

"for purposes of protecting the confidentiality, integrity, and accessibility of personal data, shall establish, implement, and maintain reasonable administrative, technical, and physical data security practices that are appropriate to the volume and nature of the personal data at issue."

2023

Reference :

HB 4

Information on Texas data protection regulations

Link to reference

Extracts :

Extract :

"opt out of the processing of the personal data for purposes of: (A) targeted advertising; (B) the sale of personal data; or (C) profiling in furtherance of a decision that produces a legal or similarly significant effect concerning the consumer."

2023

Reference :

HB 1844

Information on Texas data protection regulations

Link to reference

Extracts :

Extract :

"if the data is available in a digital format obtain a copy of the consumer’s personal data that the consumer previously provided to the controller in a portable and, to the extent technically feasible, readily usable format that allows the consumer to transmit the data to another controller without hindrance;"

2023

Reference :

HB 1844

Information on Texas data protection regulations

Link to reference

Extracts :

Extract :

Based on ref 651, there is no information/mention of anything related to restriction of automated decision making.

2023

Reference :

HB 4

Information on Texas data protection regulations

Link to reference

Extracts :

Extract :

""Consent," when referring to a consumer, means a clear affirmative act signifying a consumer’s freely given, specific, informed, and unambiguous agreement to process personal data relating to the consumer. "

2023

Reference :

HB 4

Information on Texas data protection regulations

Link to reference

Extracts :

Extract :

"Sec. 541.006. EFFECT OF COMPLIANCE WITH PARENTAL CONSENT REQUIREMENTS UNDER CERTAIN FEDERAL LAW. A controller or processor that complies with the verifiable parental consent requirements of the Children's Online Privacy Protection Act (15 U.S.C. Section 6501 et seq.) with respect to data collected online is considered to be in compliance with any requirement to obtain parental consent under this chapter."

2023

Reference :

HB 4

Information on Texas data protection regulations

Link to reference

Extracts :

Extract :

"confirm whether a controller is processing the consumer ’s personal data and to access the personal data;"

2023

Reference :

HB 1844

Information on Texas data protection regulations

Link to reference

Extracts :

Extract :

"correct inaccuracies in the consumer ’s personal data, taking into account the nature of the personal data and the purposes of the processing of the consumer’s personal data;"

2023

Reference :

HB 1844

Information on Texas data protection regulations

Link to reference

Extracts :

Extract :

"delete personal data provided by or obtained about the consumer"

2023

Reference :

HB 1844

Information on Texas data protection regulations

Link to reference

Extracts :

Extract :

Not found anything directly in HB 1184 that mentions the withdrawl of consent from the subject.

2023

Reference :

HB 4

Information on Texas data protection regulations

Link to reference

Extracts :

Extract :

No information on the HB 4 on this.

2023

Reference :

HB 4

Information on Texas data protection regulations

Link to reference

Extracts :

Extract :

No information on the HB 4 on this.

2023

Reference :

HB 4

Information on Texas data protection regulations

Link to reference

Extracts :

Extract :

No information on the HB 4 on this.

2023

Reference :

HB 4

Information on Texas data protection regulations

Link to reference

Extracts :

Extract :

No information on the HB 4 on this.

2023

Reference :

HB 4

Information on Texas data protection regulations

Link to reference

Extracts :

Extract :

No information on the HB 4 on this.

2023

Reference :

HB 4

Information on Texas data protection regulations

Link to reference

Extracts :

Extract :

No information on the HB 4 on this.

2023

Reference :

HB 4

Information on Texas data protection regulations

Link to reference

Extracts :

Extract :

No information on the HB 4 on this.

2023

Reference :

HB 4

Information on Texas data protection regulations

Link to reference

Extracts :

Extract :

"The EU Adequacy Decision allows the DPF to go into effect immediately, allowing organizations in the EEA to transfer personal data to U.S. companies that self-certify to the DPF. The DPF is based on a system of self-certification where U.S. organizations commit to a set of privacy principles identified by the Department of Commerce ("DoC") . These Principles address certain fundamental data privacy principles such as notice, choice (ability to opt out), accountability for onward transfer, security, data integrity, purpose limitation, access, and recourse. The new safeguards and redress measures controlling personal data collected by U.S. intelligence agencies also have become effective. The safeguards provide detailed guidelines and procedures governing access to personal data, including subpoena and warrant requirements. In addition, the redress measures available to individuals includes investigation of complaints by U.S. Civil Liberties Protection Officers, with appeals going to a newly created Data Protection Review Court. "

2023

Reference :

US and EU Approve Framework for Personal Data Transfers

Information on EU-US data transfer | White & Case

Link to reference

Extracts :

Extract :

"colloquially referred to as Convention 108+, was signed by Austria, Belgium, Bulgaria, Czech Republic, Estonia, Finland, France, Germany, Ireland, Latvia, Lithuania, Luxembourg, Monaco, Netherlands, Norway, Portugal, Spain, Sweden, the U.K., and by Uruguay, one of the six non-European states that have so far joined Convention 108. The other five non-European states are Cape Verde, Mauritius, Mexico, Senegal and Tunisia. Another three countries — Argentina, Burkina Faso and Morocco — have also been invited to accede to the treaty."

2018

Reference :

What does the newly signed 'Convention 108+' mean for UK adequacy?

List of countries in the Convention 108

Link to reference

Extracts :

Extract :

No information on the HB 4 on this.

2023

Reference :

HB 4

Information on Texas data protection regulations

Link to reference

Extracts :

Extract :

Since the APEC applies to the USA Federal, it is assumed that it applied to all states as well.

Reference :

International Data transfer Agreements | DataGuidance

Comparison of international data transfer agreements

Extracts :

Extract :

No information on the HB 4 on this.

2023

Reference :

HB 4

Information on Texas data protection regulations

Link to reference

Extracts :

Extract :

No information on the HB 4 on this.

2023

Reference :

HB 4

Information on Texas data protection regulations

Link to reference

Extracts :

Extract :

No information on the HB 4 on this.

2023

Reference :

HB 4

Information on Texas data protection regulations

Link to reference

Extracts :

Extract :

No information on the HB 4 on this.

2023

Reference :

HB 4

Information on Texas data protection regulations

Link to reference

Extracts :

Extract :

The notion of DPO was never found in any of the bills/Acts verified, most specifically the HB 4 which defines the actors in the data protection sphere.

2023

Reference :

HB 4

Information on Texas data protection regulations

Link to reference

Extracts :

Extract :

The notion of DPO was never found in any of the bills/Acts verified, most specifically the HB 4 which defines the actors in the data protection sphere.

2023

Reference :

HB 4

Information on Texas data protection regulations

Link to reference

Extracts :

Extract :

The notion of DPO was never found in any of the bills/Acts verified, most specifically the HB 4 which defines the actors in the data protection sphere.

2023

Reference :

HB 4

Information on Texas data protection regulations

Link to reference

Extracts :

Extract :

The notion of DPO was never found in any of the bills/Acts verified, most specifically the HB 4 which defines the actors in the data protection sphere.

2023

Reference :

HB 4

Information on Texas data protection regulations

Link to reference

Extracts :

Extract :

"how consumers may exercise their consumer rights under Subchapter B, including the process by which a consumer may appeal a controller ’s decision with regard to the consumer’s request"

2023

Reference :

HB 1844

Information on Texas data protection regulations

Link to reference

Extracts :

Extract :

The notion of DPO was never found in any of the bills/Acts verified, most specifically the HB 4 which defines the actors in the data protection sphere.

2023

Reference :

HB 4

Information on Texas data protection regulations

Link to reference

Extracts :

Extract :

"The CCPA and CPRA both provide consumers with a right to know what personal information is being collected about them, as well as a right to access their personal information."

2023

Reference :

California Data protection overview | DataGuidance

(Data Protection Overview 2023)/ DataGuidance reports

Extracts :

Extract :

"PRIVACY NOTICE. A controller shall provide consumers with a reasonably accessible and clear privacy notice that includes: (1) the categories of personal data processed by the controller; (a) if applicable, the categories must include any sensitive data processed by the controller; (2) the purpose for processing personal data; (3) how consumers may exercise their consumer rights under Subchapter B, including the process by which a consumer may appeal a controller ’s decision with regard to the consumer’s request; (4) if applicable, the categories of personal data that the controller shares with third parties; (5) if applicable, the categories of third parties with whom the controller shares personal data; and (6) a description of the methods required under Section 541.055 through which consumers can submit requests to exercise their consumer rights under this chapter."

2023

Reference :

HB 1844

Information on Texas data protection regulations

Link to reference

Extracts :

Extract :

There is no information on this in the legal text.

2023

Reference :

HB 1844

Information on Texas data protection regulations

Link to reference

Extracts :

Extract :

2023

Reference :

HB 1844

Information on Texas data protection regulations

Link to reference

Extracts :

Extract :

There is no information on this in the legal text.

2023

Reference :

HB 1844

Information on Texas data protection regulations

Link to reference

Extracts :

Extract :

There is no information on this in the legal text.

2023

Reference :

HB 1844

Information on Texas data protection regulations

Link to reference

Extracts :

Extract :

Extracts :

Extract :

Based on ref 652, there is no mention of this obligation of the Data processor.

2023

Reference :

HB 1844

Information on Texas data protection regulations

Link to reference

Extracts :

Extract :

"The Act applies to a person that (1) conducts business in Texas or produces products or services consumed by Texas residents, and (2) processes or engages in the sale of personal data (“sale” means a disclosure of personal data to a third party for “monetary or other valuable consideration”). The second prong of this language is not found in other comprehensive state privacy laws and so does not have a well-settled interpretation. The scope of the Act also excludes a small business as defined by the United States Small Business Administration, except with respect to the provision that requires small businesses to obtain consumer consent prior to selling sensitive data."

2023

Reference :

Texas Passes Data Privacy and Security Act

Information on Texas data protection | COVINGTON

Link to reference

Extracts :

Extract :

Based on ref 651, there is no information on the cookie policy. Neither does any other bill/Act mention this.

2023

Reference :

HB 4

Information on Texas data protection regulations

Link to reference

Actors
Name	Short name	Classification	Jurisdiction	Year of creation
Attorney General	AG	Regulator	Govt authority/ministry

Texts
Original text name	Legislation type	Year signed	Regulation status	In effect since
SB 820	Cybersecurity	2019	Signed, upcoming	2024
Texas Data Privacy and Security Act \| HB 4	General privacy/data protection law	2023	Signed, upcoming	2025
Texas Privacy Protection Act \| HB 4390	Data breach law	2023	Active	2024
HB 1844	Companion bill	null	Active	2019

🇺🇸 US-Texas

Data subject classification

Citizens outside their jurisdiction are considered as data subjects : No

Persons within their jurisdiction are considered as data subjects : Yes

Legal entities are considered as data subjects : No

Data controller definition and responsibilities

Differentiation between how data controller and data processor are defined : Yes

Organizations located outside the jurisdiction processing regulated subjects data are considered as data controllers within the personal data legislation : No

Organizations with economic activities within the jurisdiction are considered as data controllers within the personal data legislation : Yes

Organizations located outside the jurisdiction monitoring regulated subjects data are considered as data controllers within the personal data legislation : No

Special/sensitive personal data definition

Definition of personal data that are "special" or "sensitive": biometric data : Yes

Definition of personal data that are "special" or "sensitive": genetic data : Yes

Definition of personal data that are "special" or "sensitive": financial data : No

Definition of personal data that are "special" or "sensitive": medical/health data : Yes

Definition of personal data that are "special" or "sensitive": criminal records data : No

Definition of personal data that are "special" or "sensitive": racial/ethnic origin : Yes

Definition of personal data that are "special" or "sensitive": political opinions : No

Definition of personal data that are "special" or "sensitive": religious/philosophical beliefs : Yes

Definition of personal data that are "special" or "sensitive": trade union membership : No

Definition of personal data that are "special" or "sensitive": geo-location data : Yes

Legal bases for data processing

Potential legal bases for processing personal data: appropriate notice has been provided to or made available to the data subject : No

Potential legal bases for processing personal data: the data subject has provided consent to the processing for the identified purposes : Yes

Potential legal bases for processing personal data: the personal data is necessary to perform a contract with the data subject : Yes

Potential legal bases for processing personal data: the personal data is necessary to comply with a legal obligation : Yes

Potential legal bases for processing personal data: the personal data is necessary to protect the vital interests of a natural person : Yes

Potential legal bases for processing personal data: the personal data is necessary for a public interest : Yes

Potential legal bases for processing personal data: the personal data is necessary to fulfil a legitimate interest of the controller or third party : Yes

Enforcement and penalties

Provision of administrative penalties by laws : Yes

Max value of monetary penalties for violations (in euros) :

Consideration of turnover rates for penalties? : No

Provision of criminal penalties - fines : No

Subject private remedies - presence of individual personal actions? : No

Subject private remedies - representative actions? : No

Subject private remedies - class actions? : No

Subject private remedies - file complaints with Data Protection Authorities? : Yes

Provision of criminal penalties - imprisonment : No

Data processing and security controls

Audit or supervise Data Processors :

Requirement of a DPIA : Yes

Ensuring encryption/pseudonymisation as a security control : Yes

Requirement for Controller to notify subjects of a data breach : Yes

Requirement for Controller to notify DPA of a data breach : Yes

Requirement for Processor to notify controller of data breach : Yes

Requirement for Processor to notify DPA of data breach : No

Requirement for Processor to notify subjects of data breach : No

Obligation to maintain information security control to protect personal data from unauthorized access or processing: general technical/physical/organizational security controls : Yes

Rights of data subjects

Right to object data use or/opt out : Yes

Right to data portability : Yes

Right against automated decision making : No

Right to be informed : Yes

Consent required for processing children's data : Yes

Right to access information : Yes

Right to rectification : Yes

Right to erase : Yes

Right to withdraw consent : No

Right to restrict data processing : No

International data transfer and data localization

Legal basis for international data transfer: approved jurisdictions : No

Legal basis for international data transfer: approved standard contractual clauses : No

Legal basis for international data transfer: derogations, such as consent, contract performance, necessity to establish, exercise or defend legal claims : No

Legal basis for international data transfer: binding corporate rules : No

Data localisation requirements: retention of personal data in local jurisdiction : No

Data localisation requirements: tax or financial record laws : No

Legal basis for international data transfer: EU/EEA adequacy : Yes

Legal basis for international data transfer: Convention 108 : No

Data localisation requirements: national security laws : No

Legal basis for international data transfer: APEC CBPRs : Yes

Data localisation requirements (such data is part of another type of record or dataset): retention or storage of personal data in the local jurisdiction or otherwise prohibit the transfer or disclosure of the personal data outside of the local jurisdiction : No

Data localisation requirements: anti-investigatory/blocking statutes that restrict any activity on local territory that aids a foreign government investigation : No

Data localisation requirements: other data localization regulations (export control laws/medical laws/employment laws etc.) : No

Data protection officer (DPO) requirements

Consulting the supervisory authority (DPA) before data processing : No

Mandatory appointment of a DPO : No

Requirement of professional/legal qualification/expert knowledge for DPO : No

Clear DPO role specification : No

Group appointments: a group of undertakings to appoint a single DPO : No