Texas Cybersecurity Safe Harbor (SB 2610): A Plain-Language Guide
If your Texas organization has fewer than 250 employees and keeps a qualifying cybersecurity program, a person suing you over a data breach cannot recover exemplary (punitive) damages. Here is what the law says, who it covers and what a qualifying program looks like.
What SB 2610 is
Senate Bill 2610, passed by the 89th Texas Legislature in its 2025 regular session, added Chapter 542, “Cybersecurity Program,” to the Texas Business and Commerce Code.
The law is voluntary. It adds no penalties or filing requirements. It gives a legal defense to businesses that can show they had implemented and maintained a qualifying cybersecurity program at the time of a breach.
Texas Business and Commerce Code, “Cybersecurity Program”
Signed by the Governor
Effective date
The safe harbor applies only to a cause of action that accrues on or after the effective date
Who the safe harbor covers
Chapter 542 applies only to a business entity in Texas that:
Both must be true
- It has fewer than 250 employees.
- It owns or licenses computerized data that includes sensitive personal information.
Under Texas law, sensitive personal information includes a person’s name combined with a Social Security number, a driver’s license or government ID number, or a financial account or card number with its access code, when that data is not encrypted. It also includes information that identifies a person and relates to their health, health care or payment for health care. If you keep employee, patient or customer records, you likely hold it.
What a qualifying program looks like
Every qualifying program needs administrative, technical and physical safeguards for personal identifying information and sensitive personal information, and it must conform to an industry-recognized cybersecurity framework. The requirements scale with your headcount:
| Employees | What the law requires |
|---|---|
| Fewer than 20 | Simplified requirements, including password policies and appropriate employee cybersecurity training. |
| 20 to 99 | Moderate requirements, including the Center for Internet Security (CIS) Controls Implementation Group 1. |
| 100 to 249 | Conformity with the frameworks and standards listed in Section 542.004(b). |
Frameworks named in the law
- NIST Cybersecurity Framework (Framework for Improving Critical Infrastructure Cybersecurity)
- NIST SP 800-171, and NIST SP 800-53 and 800-53A
- FedRAMP Security Assessment Framework
- CIS Critical Security Controls
- ISO/IEC 27000-series standards
- HITRUST Common Security Framework
- Secure Controls Framework
- SOC 2
- Other similar industry frameworks or standards
Regulated organizations: if HIPAA, Title V of the Gramm-Leach-Bliley Act, FISMA or the HITECH Act applies to you, your program must also conform to the current version of it. If PCI DSS applies to you, your program must conform to it as well.
Keeping current: when a named framework is updated, you have until the later of the implementation date in the new version or one year after it is published to update your program.
What the safe harbor does and does not do
Limits exemplary damages only
It bars exemplary (punitive) damages. Other damages a court may award are not affected.
Creates no new lawsuits
The law states that it does not create a private cause of action.
Changes no existing duties
Texas breach notification rules still apply: notify affected individuals within 60 days of determining a breach occurred, and the Texas Attorney General within 30 days if at least 250 Texans are involved.
Depends on proof
You must show the program was in place and maintained when the breach happened. Documentation matters.
The practical takeaway: pick a framework that fits your size and industry, put the controls in place, keep records that prove they work, and review them when the framework changes.
How ALCON DTS helps
ALCON DTS helps Texas organizations build, run and document a cybersecurity program aligned to the framework that fits them, from password policies and security awareness training to endpoint detection and response, email security, monitoring, and tested backup and recovery. You keep the legal decisions. We run the controls and keep the evidence organized for your attorney, insurer or auditor.
For the full breakdown, including framework details, how our services map to each requirement and related Texas laws, read our Texas SB 2610 Cybersecurity Safe Harbor guide. To have us build and run the program, see Texas SB 2610 Compliance.
Official sources
- SB 2610, 89th Legislature (R), enrolled text: Chapter 542 Sections 542.001 to 542.005, applicability (Section 2) and effective date (Section 3).
- SB 2610 bill history, Texas Legislature Online: signed by the Governor June 20, 2025; effective September 1, 2025.
- Texas Business and Commerce Code, Chapter 542: the law as codified (Acts 2025, 89th Leg., R.S., Ch. 1029).
- Texas Business and Commerce Code, Chapter 521: sensitive personal information (Section 521.002) and breach notification (Section 521.053).
This article is general information, not legal advice. Talk with your attorney about how SB 2610 applies to your organization.
See where your organization stands
The readiness checklist in our SB 2610 guide walks through the program the law describes for your size, so you can see what is in place and what is missing.
