Title BC, Business and Commerce Code

Sec. 541.005. EFFECT OF COMPLIANCE WITH PARENTAL CONSENT REQUIREMENTS UNDER CERTAIN FEDERAL LAW. A controller or processor that complies with the verifiable parental consent requirements of the Children's Online Privacy Protection Act of 1998 (15 U.S.C. Section 6501 et seq.) with…

Sec. 541.051. CONSUMER'S PERSONAL DATA RIGHTS; REQUEST TO EXERCISE RIGHTS. (a) A consumer is entitled to exercise the consumer rights authorized by this section at any time by submitting a request to a controller specifying the consumer rights the consumer wishes to exercise. Wit…

Sec. 541.052. CONTROLLER RESPONSE TO CONSUMER REQUEST. (a) Except as otherwise provided by this chapter, a controller shall comply with a request submitted by a consumer to exercise the consumer's rights pursuant to Section 541.051 as provided by this section. (b) A controller sh…

Sec. 541.053. APPEAL. (a) A controller shall establish a process for a consumer to appeal the controller's refusal to take action on a request within a reasonable period of time after the consumer's receipt of the decision under Section 541.052(c). (b) The appeal process must be …

Sec. 541.054. WAIVER OR LIMITATION OF CONSUMER RIGHTS PROHIBITED. Any provision of a contract or agreement that waives or limits in any way a consumer right described by Sections 541.051, 541.052, and 541.053 is contrary to public policy and is void and unenforceable. Added by Ac…

Sec. 541.055. METHODS FOR SUBMITTING CONSUMER REQUESTS. (a) A controller shall establish two or more secure and reliable methods to enable consumers to submit a request to exercise their consumer rights under this chapter. The methods must take into account: (1) the ways in which…

Sec. 541.101. CONTROLLER DUTIES; TRANSPARENCY. (a) A controller: (1) shall limit the collection of personal data to what is adequate, relevant, and reasonably necessary in relation to the purposes for which that personal data is processed, as disclosed to the consumer; and (2) fo…

Sec. 541.102. PRIVACY NOTICE. (a) A controller shall provide consumers with a reasonably accessible and clear privacy notice that includes: (1) the categories of personal data processed by the controller, including, if applicable, any sensitive data processed by the controller; (…

Sec. 541.103. SALE OF DATA TO THIRD PARTIES AND PROCESSING DATA FOR TARGETED ADVERTISING; DISCLOSURE. If a controller sells personal data to third parties or processes personal data for targeted advertising, the controller shall clearly and conspicuously disclose that process and…

Sec. 541.104. DUTIES OF PROCESSOR. (a) A processor shall adhere to the instructions of a controller and shall assist the controller in meeting or complying with the controller's duties or requirements under this chapter, including: (1) assisting the controller in responding to co…

Sec. 541.105. DATA PROTECTION ASSESSMENTS. (a) A controller shall conduct and document a data protection assessment of each of the following processing activities involving personal data: (1) the processing of personal data for purposes of targeted advertising; (2) the sale of pe…

Sec. 541.106. DEIDENTIFIED OR PSEUDONYMOUS DATA. (a) A controller in possession of deidentified data shall: (1) take reasonable measures to ensure that the data cannot be associated with an individual; (2) publicly commit to maintaining and using deidentified data without attempt…

Sec. 541.107. REQUIREMENTS FOR SMALL BUSINESSES. (a) A person described by Section 541.002(a)(3) may not engage in the sale of personal data that is sensitive data without receiving prior consent from the consumer. (b) A person who violates this section is subject to the penalty …

Sec. 541.151. ENFORCEMENT AUTHORITY EXCLUSIVE. The attorney general has exclusive authority to enforce this chapter. Added by Acts 2023, 88th Leg., R.S., Ch. 995 (H.B. 4), Sec. 2, eff. July 1, 2024.

Sec. 541.152. INTERNET WEBSITE AND COMPLAINT MECHANISM. The attorney general shall post on the attorney general's Internet website: (1) information relating to: (A) the responsibilities of a controller under Subchapters B and C; (B) the responsibilities of a processor under Subch…

Sec. 541.153. INVESTIGATIVE AUTHORITY. (a) If the attorney general has reasonable cause to believe that a person has engaged in or is engaging in a violation of this chapter, the attorney general may issue a civil investigative demand. The procedures established for the issuance …

Sec. 541.154. NOTICE OF VIOLATION OF CHAPTER; OPPORTUNITY TO CURE. Before bringing an action under Section 541.155, the attorney general shall notify a person in writing, not later than the 30th day before bringing the action, identifying the specific provisions of this chapter t…

Sec. 541.155. CIVIL PENALTY; INJUNCTION. (a) A person who violates this chapter following the cure period described by Section 541.154 or who breaches a written statement provided to the attorney general under that section is liable for a civil penalty in an amount not to exceed …

Sec. 541.156. NO PRIVATE RIGHT OF ACTION. This chapter may not be construed as providing a basis for, or being subject to, a private right of action for a violation of this chapter or any other law. Added by Acts 2023, 88th Leg., R.S., Ch. 995 (H.B. 4), Sec. 2, eff. July 1, 2024.…

Sec. 541.201. CONSTRUCTION OF CHAPTER. (a) This chapter may not be construed to restrict a controller's or processor's ability to: (1) comply with federal, state, or local laws, rules, or regulations; (2) comply with a civil, criminal, or regulatory inquiry, investigation, subpoe…

Sec. 541.202. COLLECTION, USE, OR RETENTION OF DATA FOR CERTAIN PURPOSES. (a) The requirements imposed on controllers and processors under this chapter may not restrict a controller's or processor's ability to collect, use, or retain data to: (1) conduct internal research to deve…

Sec. 541.203. DISCLOSURE OF PERSONAL DATA TO THIRD-PARTY CONTROLLER OR PROCESSOR. (a) A controller or processor that discloses personal data to a third-party controller or processor, in compliance with the requirements of this chapter, does not violate this chapter if the third-p…

Sec. 541.204. PROCESSING OF CERTAIN PERSONAL DATA BY CONTROLLER OR OTHER PERSON. (a) Personal data processed by a controller under this subchapter may not be processed for any purpose other than a purpose listed in this subchapter unless otherwise allowed by this chapter. Persona…

Sec. 541.205. LOCAL PREEMPTION. This chapter supersedes and preempts any ordinance, resolution, rule, or other regulation adopted by a political subdivision regarding the processing of personal data by a controller or processor. Added by Acts 2023, 88th Leg., R.S., Ch. 995 (H.B. …