Who SB 2610 covers
Texas Business & Commerce Code Chapter 542 (added by SB 2610) applies to a business entity in Texas that:
- has fewer than 250 employees, and
- owns or licenses computerized data that includes sensitive personal information.
Source: enrolled SB 2610, Sec. 542.002. In effect since September 1, 2025.
Every covered business needs a program
Headcount changes how much is expected. It does not remove the requirement.
Under Sec. 542.004(a), every covered business must have a cybersecurity program that:
- contains administrative, technical, and physical safeguards,
- conforms to an industry-recognized framework listed in 542.004(b), and
- is designed to protect sensitive personal information and reduce the risk of identity theft and fraud.
How headcount scales the program
Sec. 542.004(a)(4) sets three tiers:
| Size | What the statute expects |
|---|---|
| Fewer than 20 employees | Simplified requirements, including password policies and appropriate employee cybersecurity training. That is a floor, not “passwords and training only.” A lightweight, framework-aligned program is still required. |
| At least 20 but fewer than 100 | Moderate requirements, including the Center for Internet Security Controls Implementation Group 1 (IG1). |
| At least 100 but fewer than 250 | Compliance with the framework requirements of Subsection (b). |
What counts as sensitive personal information
The bill points to the definitions in Business & Commerce Code Section 521.002 for “personal identifying information” and “sensitive personal information.” We do not reprint them here. Read the enrolled text or ask counsel.
Does my firm qualify?
This site does not decide that. It depends on your facts: employee count, whether you hold sensitive personal information, and how a court would apply the chapter. Ask a qualified Texas attorney about your situation.
If you are a Texas tax or CPA firm under 250 people and want a practical read on where you stand, the free seat check is the place to start.
Independent guide by threep (threep.ai). Not affiliated with the State of Texas or any government agency. Not legal advice. Statute: enrolled SB 2610.