2025 · Regular session · House bill
HB3112
HB3112 adds specific cybersecurity exceptions to Texas open-meetings and public-information laws.
Official caption: Relating to the application of the open meetings law and public information law to government information related to certain cybersecurity measures.
Official report lists House author(s): Tepper, Capriglione, Orr, Bumgarner. This does not identify sponsors or amendment drafters.
Bill explanation published · Version and amendment review scope is stated below · Individual amendment records may not be separately annotated.
Bill highlights
Selected points from the published explanation. Follow each point to its source-linked context; conditions and limits may matter.
- HB3112 adds specific cybersecurity exceptions to Texas open-meetings and public-information laws.
- The act permits closed deliberations; it does not repeal the rule that a final action, decision or vote on a matter discussed in a closed meeting must occur in a properly noticed open meeting.
- The new records provision lists information related to qualifying protective cybersecurity measures, policies or contracts; specified insurance coverage limits, deductibles and self-insurance reserves; cybersecurity incidents reported under state law; and network schematics, configurations, encryption or incident-response practices whose disclosure would facilitate unauthorized access to data or technology resources.
- Disclosure remains possible to comply with state or federal law or a court order.
- The governor signed the bill and it took effect June 20, 2025, after House and Senate votes exceeding the threshold for immediate effect.
What does it do?
HB3112 adds specific cybersecurity exceptions to Texas open-meetings and public-information laws. A governmental body may deliberate privately about a cybersecurity measure, policy or contract solely intended to protect a critical infrastructure facility within its jurisdiction. The defined facilities include communications and cybersecurity systems, electricity and natural-gas infrastructure, dams, hazardous-waste systems, and water and wastewater facilities. This is not a blanket exemption for every discussion involving technology. Final law.
The act permits closed deliberations; it does not repeal the rule that a final action, decision or vote on a matter discussed in a closed meeting must occur in a properly noticed open meeting. Open-vote requirement.
The new records provision lists information related to qualifying protective cybersecurity measures, policies or contracts; specified insurance coverage limits, deductibles and self-insurance reserves; cybersecurity incidents reported under state law; and network schematics, configurations, encryption or incident-response practices whose disclosure would facilitate unauthorized access to data or technology resources. These are confidentiality protections, not a new requirement to buy insurance or install particular security equipment.
Disclosure remains possible to comply with state or federal law or a court order. Required disclosure triggers notice to the owner of the critical infrastructure facility at least five business days beforehand. If immediate disclosure is required, written notice must follow as soon as practicable, no later than five business days afterward. Existing labels identifying the information as confidential or privileged must be retained. The notice does not give the owner a veto over a required disclosure.
The governor signed the bill and it took effect June 20, 2025, after House and Senate votes exceeding the threshold for immediate effect. Official history.
What changed along the way?
The filed bill already contained the core closed-meeting and records exceptions. The House committee substitute added advance notice to the information’s owner and subject, plus preservation of existing labels when disclosure was required.
The one indexed floor amendment, Tepper’s adopted House amendment, added dams, changed the notice recipient to the critical-infrastructure facility’s owner, added the immediate-disclosure alternative, and specified preservation of confidential or privileged labels. Those changes survived into the final law. The House-passed, Senate-reported and enrolled texts agree on the substantive provisions; there was no conference rewrite. All text versions.
For the full amendment record, open the official amendment index.
Official bill versions
Compare the published text versions in the official text index. A change is not attributed to a specific amendment here without a verified record.
Who could benefit—and who could bear the costs?
Governmental bodies and infrastructure operators can protect sensitive details that could assist cyberattacks, while facility owners gain notice when protected information must be disclosed. Residents, journalists and other requesters face reduced access to the specified records and deliberations. Existing law already protected various computer-security information and security discussions, so the bill is an addition to that framework, not the first cybersecurity exception.
The May 21 fiscal note anticipates no significant state or local-government fiscal impact, assuming implementation can use existing resources. That budget estimate does not measure the value of avoided attacks or the public cost of reduced transparency. The act makes no appropriation.
Official sources
- Bill history and latest recorded action
- Bill versions, analyses and fiscal notes
- Action history and votes
- Amendment index
Catalog report retrieved 2026-10-25. Check the official record for corrections or later changes.
