Texas Provides Small Businesses With Limited Immunity For Some Data Breaches

Texas Gov. Greg Abbott recently signed a limited immunity bill, S.B. 2610, for companies that suffer a data breach. The law insulates small businesses from "exemplary damages"—e.g., punitive damages or other damages awarded as a penalty—for a data breach if they maintained appropriate security controls. But the law does not foreclose lawsuits or limit compensatory damages for the breach. The law's narrow scope and ambiguities do little to change the risk calculus for Texas businesses. This approach signals a worrying backslide from progress made in other states towards meaningful reform on breach litigation.

Application: Small Businesses

Texas' law applies to businesses "in th[e] state" with fewer than 250 employees that have sensitive personal information (i.e., elements triggering notice under Texas law). But this straightforward provision buries a landmine: What does it mean to be "in" Texas? The law does not say whether this covers those incorporated in the