Texas Amends Data Breach Notification Law, Creates Public Listing Of Data Breaches

On June 14, Texas Governor Greg Abbott signed House Bill 3746, which amends Texas's data breach notification law. In doing so, Texas joins other states in requiring its attorney general to maintain a public listing of data breaches on its website. The amendments take effect September 1, 2021. 

What does the Texas data breach reporting law require? 

Texas Business and Commerce Code § 521.053 requires businesses to notify individuals and the Texas Attorney General after discovering or receiving notification of "any breach of system security." The notice must go to any individual whose sensitive personal information was, or is reasonably believed to have been, breached within 60 days. The Texas Attorney General must be notified within 60 days if the breach involves at least 250 Texas residents.