SB2610

New Business & Commerce Code Chapter 542 applies to a business entity in Texas with fewer than 250 employees that owns or licenses computerized data containing sensitive personal information. Exemplary damages means punishment rather than compensation and includes punitive damages. The protection addresses that category of damages, not a blanket bar on claims for actual loss. The entity must demonstrate that it implemented and maintained a compliant program at the time of the breach. Final law, sections 542.001–.003; Damages definitions.

The incorporated breach definition covers unauthorized acquisition compromising sensitive information, including encrypted data when the person accessing it has the decryption key. Good-faith employee or agent acquisition for the business’s purposes is excluded unless the information is used or disclosed without authorization. Sensitive information includes specified unencrypted name-and-identifier or financial-access combinations and identifying health information; lawfully public government information is excluded. Breach definition; Information definitions.

A qualifying program must include administrative, technical and physical safeguards, conform to an industry-recognized framework, and be designed to protect information security and integrity and prevent unauthorized access or acquisition creating a material risk of identity theft or other fraud. Its scale-and-scope requirements vary: fewer than 20 employees means simplified requirements including password policies and appropriate employee training; 20–99 means moderate requirements including CIS Controls Implementation Group 1; 100–249 means compliance with subsection (b). These tiers accompany the common requirements, so passwords or training alone do not automatically qualify a business. Final law, section 542.004(a).

Subsection (b)(1) permits current versions or combinations of listed frameworks: the NIST Cybersecurity Framework, NIST 800-171, NIST 800-53/800-53A, FedRAMP, CIS Controls, ISO/IEC 27000-series, HITRUST, Secure Controls Framework, Service Organization Control Type 2, or similar industry standards. In addition, subsection (b)(2) requires conformity to the listed federal laws where the business is subject to them—HIPAA, Gramm-Leach-Bliley Title V, FISMA and HITECH—and (b)(3) requires the Payment Card Industry Data Security Standard where applicable. The wording does not make applicable sector or payment-card obligations optional substitutes for a chosen framework. This explanation does not determine which federal laws apply to a particular business. Final law, section 542.004(b).

CIS describes Implementation Group 1 in Controls v8/v8.1 as 56 foundational safeguards for essential cyber hygiene. NIST’s current framework publication is CSF 2.0, published February 26, 2024; it describes cybersecurity outcomes rather than a one-size-fits-all technical checklist. Its earlier title was the Framework for Improving Critical Infrastructure Cybersecurity, the name used in the act. These publisher descriptions help explain the references; they are not a certification that any business meets the Texas defense. For updates to subsection (b)(1) standards, the act allows a program to remain qualifying if updated by the later of the standard’s published implementation date or one year after publication of the update. CIS IG1; NIST CSF 2.0; Final law, section 542.004(c).

The introduced bill would have imposed liability where failed reasonable controls caused a breach and economic harm. The Senate committee substitute instead created the limited punitive-damages protection, added the fewer-than-250 limit and employee tiers, removed Department of Public Safety determination language, and replaced a 180-day update period with the later-of-one-year-or-implementation-date rule. The single indexed floor amendment, offered by Senator Blanco and adopted April 30, replaced separate attorney-general and class-action provisions with a rule that the chapter creates no private cause of action and changes no common-law or statutory duty. That amendment survives in the final law; the House and enrolled operative texts match the Senate-passed version. Versions; Amendment index; Blanco amendment; Final law, section 542.005.

Compare the published text versions in the official text index. A change is not attributed to a specific amendment here without a verified record.

Qualifying businesses may reduce exposure to punishment-based damages, but must implement, maintain and be able to demonstrate the required protections. People harmed by a breach lose access to that category of damages against a qualifying entity; other recovery still depends on applicable law and proof, not this act’s creation of a new claim. The statute may encourage security investment, but does not measure how many breaches will be avoided or how much compliance will cost. Final law.

The engrossed fiscal note anticipates no significant state or local fiscal implication and assumes state costs can be absorbed with existing resources. It does not estimate business compliance spending or individual lawsuit recoveries, and no appropriation is made by SB2610. Fiscal note; Earlier notes.