Texas cybersecurity laws, reporting deadlines and notification requirements in one place, organized by industry. Every requirement links to the statute or regulator that sets it.
Most legal clocks run from when you discover or determine a breach, not from when you finish investigating. Shortest first.
>_ clocks --sort=shortest11 tracked
1 hourElectric utilities under NERC CIPInitial notice of a Reportable Cyber Security Incident to the E-ISAC and CISA, after it is determined to be reportable.NERC CIP-008-6 (opens in a new tab)
36 hoursBanks (federal banking regulators)Notify your primary federal regulator after determining a “notification incident” occurred.Federal Register, 2021 (opens in a new tab)
48 hoursTexas state agencies, local governments, school districtsReport a cybersecurity incident (breach, suspected breach, or ransomware) to the Texas Cyber Command. Calling the hotline counts.Gov’t Code §2063.302 (opens in a new tab)
72 hoursDefense contractors (DFARS 252.204-7012)Report cyber incidents affecting covered defense information to the DoD.DIBNet (opens in a new tab)
4 business daysPublic companiesFile Form 8-K (Item 1.05) after deciding a cybersecurity incident is material.SEC, 2023 (opens in a new tab)
10 business daysTexas state agencies & local governmentsAfter eradication, closure and recovery: send the Texas Cyber Command the incident details and a root-cause analysis.Gov’t Code §2063.302 (opens in a new tab)
30 daysAnyone doing business in TexasNotify the Texas Attorney General of a breach affecting 250 or more Texans, using the AG’s online form.Bus. & Com. Code §521.053 (opens in a new tab)
30 daysNon-bank financial institutions (FTC)Notify the FTC of unauthorized acquisition of unencrypted data of 500 or more consumers.FTC Safeguards Rule (opens in a new tab)
60 daysAnyone doing business in TexasNotify each affected person of a breach of sensitive personal information, without unreasonable delay.Bus. & Com. Code §521.053 (opens in a new tab)
60 daysHIPAA covered entitiesNotify affected individuals; HHS too if 500 or more (smaller breaches: annual log to HHS); media if more than 500 in a state.HHS Breach Notification Rule (opens in a new tab)
These apply across industries. Sector rules in section 03 stack on top of them.
Bus. & Com. Code §§521.052, 521.053, 521.151
Data breach notification
applies toAnyone who conducts business in Texas and owns, licenses or maintains computerized sensitive personal information, including about people who live in other states.
Keep reasonable procedures to protect sensitive personal information (§521.052).
Notify affected people without unreasonable delay, no later than 60 days after determining a breach occurred.
Notify the Attorney General within 30 days if 250 or more Texans are affected, using the AG’s electronic form. The AG publishes these reports.
More than 10,000 people notified: also tell the nationwide consumer reporting agencies.
penalty$2,000–$50,000 per violation, plus up to $100 per person per day of failed notice (capped at $250,000 per breach).
applies toBusinesses that operate in Texas (or sell to Texans) and process or sell personal data, unless they are a small business under the SBA definition. Small businesses still need consent before selling sensitive data.
Give Texans rights to access, correct, delete and port their data, and to opt out of sale, targeted advertising and profiling.
Honor universal opt-out signals such as Global Privacy Control (since January 1, 2025).
Post a privacy notice; use reasonable data security; get consent for sensitive data.
penaltyAttorney General only (no private lawsuits). 30-day cure period, then up to $7,500 per violation.
applies toTexas businesses with fewer than 250 employees that hold sensitive personal information.
Not a mandate, an incentive: if you can show a written cybersecurity program, scaled to your size and based on a recognized framework, was in place at the time of a breach, you are shielded from exemplary (punitive) damages in a breach lawsuit.
It does not stop lawsuits, compensatory damages or Attorney General enforcement. Documentation is everything.
Pick your sector. Many organizations sit in more than one (a city that runs a water utility, a clinic that takes card payments): read each that applies.
>_ sector --local-gov5 rules
Cities, counties & special districts
48 hReport a cybersecurity incident to the Texas Cyber Command within 48 hours of discovery; election data goes to the Secretary of State. Then a details + root-cause report within 10 business days of recovery. Gov’t Code §2063.302 ↗ (opens in a new tab)
Aug 31Employees and elected or appointed officials who use a computer for at least 25% of their duties complete certified cybersecurity and AI training; the governing body certifies compliance by August 31. TXCC training program ↗ (opens in a new tab)
noteLocal electric providers that already report to ERCOT under Utilities Code §39.151 are exempt from the 48-hour TXCC report for those incidents. Gov’t Code §2063.302 ↗ (opens in a new tab)
noteFree: statewide MS-ISAC membership, TX-ISAO threat sharing, and CISA scanning. Federal SLCGP grant money flows mostly to local governments (80%), with at least 25% for rural communities. DIR / MS-ISAC ↗ (opens in a new tab)
>_ sector --state3 rules
State agencies & public universities
48 hSame 48-hour / 10-business-day reporting to the Texas Cyber Command, through the SPECTRIM portal or the 24/7 hotline. TXCC reporting ↗ (opens in a new tab)
noteCybersecurity functions moved from DIR to the Texas Cyber Command (HB 150); the transfer is due to finish by December 31, 2026. Expect some links and forms to change. TXCC transition ↗ (opens in a new tab)
ASAPReport any attack that is a breach of student information as soon as practicable; the coordinator notifies parents. Districts file through the same TXCC local incident form, which also satisfies §11.175. TXCC reporting ↗ (opens in a new tab)
90 dTrain staff on state and federal health-privacy law within 90 days of hire, and again when the law changes their duties; keep signed records. H&S Code §181.101 ↗ (opens in a new tab)
NowSince January 1, 2026, electronic health records of Texas patients must be physically stored in the United States, including at cloud and backup vendors (SB 1188). H&S Code ch. 183 ↗ (opens in a new tab)
60 dHIPAA breach notice: individuals within 60 days; HHS within 60 days if 500+ (annually if fewer); media if more than 500 in a state. Texas AG notice still applies at 250+ Texans. HHS ↗ (opens in a new tab)
30 dNon-bank financial institutions (mortgage brokers, auto dealers that finance, tax preparers, etc.): FTC notice within 30 days for 500+ consumers, plus a written information security program. FTC Safeguards Rule ↗ (opens in a new tab)
1 hBulk electric system entities: initial report of a Reportable Cyber Security Incident to the E-ISAC and CISA within one hour of determination; attempted compromises by the end of the next calendar day. NERC CIP-008-6 ↗ (opens in a new tab)
noteMunicipal and cooperative providers that report to ERCOT under Utilities Code §39.151 are exempt from the state 48-hour report for those incidents. Gov’t Code §2063.302 ↗ (opens in a new tab)
>_ sector --water3 rules
Water & wastewater
48 hPublic water systems run by a city, county, district or authority report incidents to the Texas Cyber Command within 48 hours. Gov’t Code §2063.302 ↗ (opens in a new tab)
5 yrCommunity water systems serving more than 3,300 people: risk and resilience assessment and emergency response plan, certified to EPA and reviewed every five years. EPA · AWIA §2013 ↗ (opens in a new tab)
noteFree help right now: Project Watershed 250 (Texas Cyber Command + White House), CISA scanning, EPA technical assistance. See the water & infrastructure page. Project Watershed 250 ↗ (opens in a new tab)
>_ sector --public-co1 rule
Public companies
4 bdDisclose a material cybersecurity incident on Form 8-K (Item 1.05) within four business days of determining it is material; describe cyber risk management annually in the 10-K. SEC ↗ (opens in a new tab)
noteCMMC requirements are being phased into DoD contracts, including third-party assessments for many contractors. DoD CIO · CMMC ↗ (opens in a new tab)
>_ sector --ci2 rules
Critical infrastructure (all 16 sectors)
PendingCIRCIA: once the final rule takes effect, covered entities will report substantial cyber incidents to CISA within 72 hours and ransom payments within 24 hours. As of this review the final rule was under White House review and not yet in force. CISA · CIRCIA ↗ (opens in a new tab)
Not legal advice. This page summarizes public law and regulator guidance as of Nov 10, 2026 and is offered as a free awareness resource. Laws change, and how they apply depends on your facts. Read the linked source and talk to your attorney before acting.
