The TDPSA reaches businesses that operate in Texas or serve Texas residents, process or sell personal data, and are not small businesses under the SBA definition. Because the law avoids the numeric consumer-count thresholds used in other states, scope turns on whether you are an SBA small business, not on how many records you hold. If you are in scope, the reasonable-security requirement is a baseline legal obligation enforced by the Texas Attorney General, and the practical work of meeting it is a security program, not a paperwork exercise.
Scope is tied to the SBA small-business definition, not a record count.
The TDPSA applies to a person who conducts business in Texas or produces products or services consumed by Texas residents, processes or engages in the sale of personal data, and is not a small business as defined by the United States Small Business Administration. This is a meaningful difference from laws in other states that exempt businesses below a fixed number of consumers or a revenue line tied to selling data.
Because the exemption uses the SBA definition rather than a numeric data threshold, a business with a relatively small volume of personal data can still be in scope if it exceeds the SBA small-business size standard for its industry. The practical effect is that many mid-sized Texas businesses are covered even though they would fall outside comparable laws elsewhere.
There is a narrower obligation worth noting even for SBA small businesses: the law restricts the sale of sensitive data without consent. Determining your status is a legal question for counsel; once status is settled, Cyber One Solutions scopes the security program to the data you actually hold.
The reasonable-security requirement is the part Cyber One Solutions owns.
The TDPSA requires controllers to establish, implement, and maintain reasonable administrative, technical, and physical data security practices appropriate to the volume and sensitivity of the personal data. The word reasonable is deliberately scaled: a business holding large volumes of sensitive data is expected to do more than one holding a small amount of low-sensitivity data.
Administrative practices are the policies and procedures governing who may access data, how access is granted and revoked, how the workforce is trained, and how incidents are handled. Technical practices are the controls that enforce those policies: authentication, encryption, logging, monitoring, and patching. Physical practices protect the facilities and devices where data lives.
Cyber One Solutions implements all three and documents them, so that the reasonable-security obligation is backed by evidence rather than assertion. If the Attorney General investigates, your documented controls and logs are what demonstrate that reasonable practices were in place and operating.
The Texas Attorney General enforces the TDPSA, with a cure period and per-violation penalties.
Enforcement authority rests exclusively with the Texas Attorney General. There is no private right of action, so individual consumers cannot sue under the TDPSA; the state brings any enforcement action. Before suing, the Attorney General must provide notice of an alleged violation and a 30-day period to cure it.
If a violation is not cured within that window, civil penalties can reach USD 7,500 per violation, and a single set of facts can give rise to many violations. The cure period is an opportunity, but relying on it as a strategy is risky: a controller that cannot quickly produce evidence of its security practices is poorly positioned to cure inside 30 days.
The stronger posture is a documented, operating security program that makes a violation less likely and a cure straightforward if one is alleged. That documentation, the data map, the access and encryption configuration, the monitoring logs, and the incident response plan, is exactly what Cyber One Solutions builds and maintains.
