Texas privacy law and your customer data: what your software needs to handle

The short version for busy leaders

Two sets of Texas rules matter most for customer data. The Texas Data Privacy and Security Act, which took effect on July 1, 2024 according to the Texas State Law Library, gives consumers rights to know, correct and delete their personal data and requires covered businesses to publish a privacy notice and keep data secure; small businesses as defined by the SBA are generally exempt, though they still need consent to sell sensitive data. Separately, Sections 521.052 and 521.053 of the Texas Business and Commerce Code require businesses to protect sensitive personal information and to notify people, and in larger cases the Attorney General, after a breach.

I am a software person, not a lawyer, and nothing here is legal advice. Whether a specific law applies to your company, and exactly what it requires, is a question for a licensed Texas attorney. What I can explain is the practical side: what these rules ask your systems to do, and why companies whose data is scattered across spreadsheets and old applications often struggle to comply.

What the Texas Data Privacy and Security Act asks of a business

According to the Texas State Law Library's summary, the law covers businesses that collect, store, process or sell consumer data linked to a specific person. It treats certain categories as sensitive, including data revealing race, religion, health, immigration status, genetic data, precise geolocation and data about children under 13. Data already governed by federal laws such as HIPAA and the Fair Credit Reporting Act is excluded, and several types of organizations are exempt.

For businesses it does cover, the summary lists rights consumers can exercise and duties the business must meet. Each of them has a direct software consequence, which is where my work comes in.

• Consumers can learn whether a company processes their personal data and get it in a readily usable format.
• They can have inaccurate data corrected and have their data deleted.
• They can opt out of targeted advertising, the sale of their data and certain profiling.
• Businesses must provide an accessible privacy notice and limit collection to the purposes they disclose.
• Businesses must offer a way to submit requests, respond in a timely way and provide an appeal process.
• Businesses must maintain reasonable data security practices.

Breach rules that reach almost every business

The breach and data-protection sections of the Business and Commerce Code apply more broadly. Section 521.052 requires a business to implement and maintain reasonable procedures to protect sensitive personal information from unlawful use or disclosure, and to destroy customer records containing such information, by shredding, erasing or making it unreadable, once they are no longer to be kept.

Section 521.053 sets the breach deadlines. A business must notify affected individuals without unreasonable delay and no later than 60 days after it determines that a breach occurred, with limited exceptions. If the breach involves at least 250 Texas residents, the business must also notify the Attorney General electronically, as soon as practicable and no later than 30 days after that determination, including details such as the number of Texans affected and the steps taken.

Those deadlines assume you can quickly answer some hard questions: what data was exposed, whose it was and how many of them live in Texas. If your records are spread across systems that do not talk to each other, answering those questions in days rather than weeks becomes the real challenge.

Why compliance is a software problem, not only a policy

A privacy notice is a document. Honoring a consumer's request to see or delete their data is an operation, and it depends entirely on whether your systems can find every record about that person. In many growing companies the same customer lives in a CRM, an accounting package, an operations system, a few spreadsheets and a folder of scanned PDFs. Finding all of it means a manual search; deleting all of it reliably is harder still.

This is the same siloed data problem that causes mismatched reports, seen from a legal angle. My guide on fixing siloed data explains how companies bring scattered records together under one identity, which is the foundation for answering privacy requests and breach questions with confidence.

Questions to ask about your current systems

Before you talk to a lawyer or a software team, walk through these questions with whoever runs your systems. The answers show how ready you are and where the gaps are. Write them down; they are useful to both the attorney and the engineers.

If several answers are I do not know, that is not unusual. It simply tells you where to start. In my experience the first question, where personal data lives, takes the longest to answer and produces the most surprises: old exports on shared drives, customer lists in email attachments and forms that collect more than anyone remembers asking for. Finding those copies is worth the effort, because data you forgot you had is still data you are responsible for.

• Where does personal data about customers, patients or employees live, in every system and file?
• Could we produce everything we hold about one person within a reasonable time?
• Could we delete or correct it everywhere, including backups and exports?
• Which data counts as sensitive, and who can see it today?
• Do we log who views and changes personal records?
• If we had a breach tomorrow, could we tell how many affected people live in Texas?

Building privacy into the system itself

The Federal Trade Commission's guide for businesses on protecting personal information boils the job down to five principles: take stock of what personal information you have, scale down to keep only what you need, lock it to protect what you keep, pitch it by properly disposing of what you no longer need, and plan ahead for security incidents. Those principles translate directly into how good software is designed, and they are far cheaper to build in from the start than to retrofit later.

When we build or modernize a system at Aezion, privacy is part of the Design stage rather than a feature added later. Our data privacy work supports compliance through data discovery, masking and anonymization, and the same thinking shapes every application we build.

• Take stock: a data inventory that maps every personal field to its system and purpose.
• Scale down: collect only fields with a clear business use, and set retention periods.
• Lock it: role-based access, encryption and logs of who touched sensitive records.
• Pitch it: automated deletion when retention periods end or a valid request arrives.
• Plan ahead: monitoring and an incident plan that can answer who, what and how many quickly.

Generative AI and sensitive data

Many companies want to use generative AI on their documents and customer records, and many are rightly nervous about sending that data to public tools. The risk is not theoretical: once sensitive information leaves your control, honoring a deletion request or scoping a breach becomes much harder.

One answer is a private deployment. Our Private GPT work runs generative AI in a private, controlled environment and uses de-identification to protect sensitive data, so document automation or an internal chatbot can work with company information without exposing it. Whatever approach you choose, include AI tools in your data inventory and your attorney's review, just like any other system that touches personal data.

Who does what: the attorney, IT and the software team

Privacy compliance works best as a team effort with clear roles. Your attorney decides which laws apply, what your privacy notice must say and how to respond to requests and incidents; a business lawyer such as Steven Besly is the right first call for those questions. Your IT provider manages devices, accounts and network security. Your software team makes sure the systems can actually do what the law and the policy require.

Cloud hosting adds another layer, because data in Azure or AWS is only as secure as the access rules you set. My guide on moving to the cloud without cost or security surprises covers identity and access as part of migration planning.

Keeping it compliant after the work is done

Privacy readiness decays. New fields get added, new tools get connected, employees change roles and keep access they no longer need. Schedule a periodic review of who can see what, check that deletion and retention rules still run, and include privacy in the testing of every significant change to your systems. When you add a new vendor or tool that will hold customer data, ask the same questions you asked of your own systems before it goes live, not after.

Security patching belongs in the same routine, because an unpatched application is one of the easier ways for data to leak. My guide on maintaining custom software after launch explains how to build that into a support plan.

Talking through your data with us

If your answers to the questions above showed gaps, bring them to a first conversation. We will look at where personal data lives in your systems, how hard it would be to find, correct or delete it, and whether the right step is a data inventory, better access controls, an integration project or a modernized application. We work alongside your attorney, not in place of one.

Companies across Dallas–Fort Worth can meet us in Frisco, and we support clients in healthcare, finance and other regulated industries nationwide. The goal is simple: systems that make the right thing easy, so compliance does not depend on someone remembering to search five places.

Questions people ask me