DSAR Requirements in Texas (TDPSA)

Consumer Rights That Trigger DSARs

Texas consumers can submit requests to:

• Access all personal data you hold about them
• Correct inaccurate personal data
• Delete personal data you collected
• Port their data in a portable, machine-readable format
• Opt out of the sale of personal data
• Opt out of targeted advertising
• Opt out of profiling that produces legal or similarly significant effects

Response Deadline

45 days from receipt. You can extend by an additional 45 days if reasonably necessary — but you must notify the consumer of the extension and the reason.

Identity Verification

Required before fulfilling any request. The TDPSA does not prescribe a specific verification method.

Appeal Process

If you deny a request, the consumer can appeal. You must provide notice of their right to contact the Texas Attorney General if the appeal is denied.

Penalties

• $7,500 per violation
• $25,000 per violation involving minors' data
• 30-day cure period available through January 1, 2026
• No private right of action — only the Attorney General can enforce

Enforced by the Texas Attorney General.

DSAR-Specific Exemptions

You may decline or limit a request when the data is needed to:

• Comply with a legal obligation
• Prevent fraud or security incidents
• Complete a transaction the consumer requested

Sensitive data (racial/ethnic origin, religious beliefs, health data, sexual orientation, biometric data, children's data, geolocation) requires opt-in consent before processing.

Who This Applies To

Any business that processes or sells personal data and is not a small business as defined by the SBA — unless the business sells sensitive data (then all sizes are covered).

For the full Texas privacy law guide, see boringgovernance.com.

Related Guides

• How to Respond to a DSAR — response process
• DSAR Response Deadlines — all deadlines
• DSAR Identity Verification — verification methods
• DSAR Exemptions — when you can refuse