The Texas Data Privacy and Security Act, which goes into effect July 1, 2024, imposes restrictions on how certain businesses can collect and use data. It also provides rights to consumers regarding disclosures and how their data is used.

The law only applies if a business:

  1. Collects or sells “personal data,” and
  2. Is not considered a small business as defined by the U.S. Small Business Association.

Personal data is any information, including sensitive data, that is linked or reasonably linkable to an identified or identifiable individual. The term does not include publicly available information or data that has been made anonymous.

The SBA determines whether a real estate business is a small business based on its total annual gross revenue and six-digit National American Industry Classification System code. A real estate business is considered a small business if it is independently controlled and operated and makes less annual gross revenue than the number below (the National American Classification System codes are included in parentheses):

  • Offices of Real Estate Agents and Brokers (531210): $15 million
  • Residential Property Managers (531311): $12.5 million
  • Nonresidential Property Managers (531312): $19.5 million
  • Offices of Real Estate Appraisers (531320): $9.5 million

If an office of real estate agents and brokers (NAICS code 531210) in Texas has an annual gross income of $15 million or more, the full scope of the law applies, including disclosing how a consumer’s data is used, providing opt-out provisions, and limiting how data may be used. If, however, the brokerage has annual gross income below $15 million, the law does not apply unless the brokerage collects “sensitive data.”

Sensitive data is information that reveals racial or ethnic origin, religious beliefs, mental or physical health diagnoses, sexuality, citizenship or immigration status, genetic or biometric data that uniquely identifies the person, data from a known child, or precise geolocation data.

To determine how the Texas Data Privacy and Security Act may affect your business, speak with an attorney or data security specialist.