Lion Cipher Lab

Does Texas's TDPSA apply to you? Run both prongs, check the SBA small-business carve-out, and draft the sale-of-sensitive-data notice

• GRC / Compliance
• Intermediate
• ~75 min
• Free · no account required

Why it matters

Texas is one of the largest markets in the country, and its comprehensive privacy law is in force today - so almost any company with a national footprint hits it. But the TDPSA is the regime that most sharply teaches a lesson the first three do not: it has NO revenue threshold and NO data-volume threshold at all. California pulls you in on revenue; Virginia and Colorado pull you in on consumer counts; Texas asks a completely different question - are you a small business as the U.S. Small Business Administration defines it? If not, and you touch Texans' personal data, you are in scope, no…

What you'll learn

• running the TDPSA applicability test as TWO prongs and seeing there is NO revenue threshold and NO data-volume threshold anywhere in the law
• explaining why the TDPSA is unusually broad-yet-narrow: nearly every business that touches Texans' data is in scope UNLESS it qualifies as an SBA small business
• applying the U.S. Small Business Administration size-standards test (by NAICS code, measured in employees or average annual receipts) as the real gate for a small company
• remembering the one obligation a small business keeps: it may not SELL a consumer's SENSITIVE personal data without first obtaining consent
• recognizing sensitive data and knowing it needs opt-IN consent before processing, not merely a right to limit
• drafting the exact conspicuous notices Texas uniquely requires when a controller sells sensitive or biometric personal data
• wiring recognized opt-out preference signals into a programme and dating the duty correctly to 1 January 2025
• mapping the Texas consumer rights onto an intake-to-response workflow with the 45-day clock and the mandatory appeal step
• listing the kinds of processing that force a Data Protection Assessment
• getting enforcement right - Texas Attorney General only, no private right of action, a 30-day cure that does NOT sunset, and penalties up to $7,500 per violation

Steps in this lab

1. The vocabulary, the citation, and who enforces this
2. Set up the worksheet - five tabs, named now, filled as you go
3. The applicability test - two prongs, and the surprise is that there is no threshold
4. The gate that actually decides scope - the SBA small-business carve-out (and its one exception)
5. The consumer rights and the workflow - the 45-day clock and the mandatory appeal
6. The obligations - the privacy notice, the unique sale notices, recognized opt-out signals, and the DPA triggers
7. TDPSA vs CCPA vs VCDPA vs CPA - the differences that change your answer (aside)
8. The pro move - build to the multi-state matrix, not one law at a time

Open the full interactive lab →