Texas SB 2610 Explained for Small Businesses
Most cybersecurity laws tell businesses what they must do. Texas Senate Bill 2610 works differently. It offers small and mid-size businesses something in return for doing the right thing: if you had a qualifying cybersecurity program in place when a data breach happened, the people suing you over that breach can't collect exemplary (punitive) damages from you.
For owners in Lubbock, Amarillo, Abilene, Midland-Odessa and South Plains towns like Levelland, Brownfield and Lamesa, that's worth understanding. A breach is bad enough. A lawsuit that adds punitive damages on top of everything else can be what turns a hard year into a business-ending one.
This post walks through what the law actually says, who it covers, what it expects at each company size, and how to get ready. It's a plain-English summary, not legal advice, so talk with your attorney about how it applies to you.
What SB 2610 is
SB 2610 was passed by the 89th Texas Legislature in 2025 and signed by the governor on June 20, 2025. It took effect September 1, 2025. It adds a new Chapter 542, "Cybersecurity Program," to the Texas Business & Commerce Code. You can read the enrolled bill text and its legislative history on the Texas Legislature's website.
The core idea is a safe harbor. In a lawsuit arising from a breach of system security, a covered business can avoid exemplary damages if it shows that, at the time of the breach, it "implemented and maintained" a cybersecurity program that meets the law's requirements. The safe harbor applies only to lawsuits over breaches that happen on or after September 1, 2025.
Who it covers
The law applies to a business in Texas that:
has fewer than 250 employees, and
owns or licenses computerized data that includes sensitive personal information.
"Sensitive personal information" comes from the existing Texas breach law in Chapter 521 of the Business & Commerce Code. It includes a person's name combined with an unencrypted Social Security number, driver's license or other government ID number, or a financial account or card number along with the code needed to use it. It also includes information that identifies someone and relates to their health, their health care, or payment for that care.
In practice, that covers a lot of West Texas businesses: medical and dental clinics, CPA and tax offices, law firms, insurance agencies, title companies, auto dealers, ag lenders, and any employer that keeps employee Social Security numbers on a computer.
What the law expects, by company size
Every qualifying program must include administrative, technical and physical safeguards for personal and sensitive information. It must be designed to protect that information's security and integrity and to prevent unauthorized access that could lead to identity theft or fraud. It must also conform to an industry-recognized cybersecurity framework.
The law then scales the expectations to the size of the business:
Fewer than 20 employees: "simplified requirements," which the law says include password policies and appropriate employee cybersecurity training.
20 to 99 employees: "moderate requirements," which the law says include the Center for Internet Security (CIS) Controls Implementation Group 1. CIS describes IG1 as essential cyber hygiene, a foundational set of 56 safeguards meant for organizations with limited IT and security staff.
100 to 249 employees: full conformity with one or more of the recognized frameworks listed in the law.
The frameworks the law names include the NIST Cybersecurity Framework, NIST SP 800-171, NIST SP 800-53, FedRAMP, the CIS Critical Security Controls, ISO/IEC 27000-series standards, HITRUST CSF, the Secure Controls Framework, SOC 2, and "other similar frameworks." If your business is already subject to HIPAA, HITECH, the Gramm-Leach-Bliley Act or FISMA, your program must conform to those rules too. If you take credit cards, the law points to the current PCI DSS standard.
One more detail matters over time. When a framework is updated, you have until the later of the new version's implementation date or one year after it's published to bring your program up to date. A program you set up once and never revisit can drift out of the safe harbor.
What SB 2610 doesn't do
It's easy to overread this law, so it's worth being clear about its limits:
It doesn't stop lawsuits. People affected by a breach can still sue. The safe harbor only blocks exemplary damages.
It doesn't remove your other duties. Texas law already requires businesses to use reasonable procedures to protect sensitive personal information and to destroy records properly when they're no longer needed. Those duties still apply, and the new chapter says it doesn't change any common-law or statutory duty.
It doesn't replace breach notification. Under Chapter 521, you still have to notify affected people no later than 60 days after determining a breach happened. If the breach involves at least 250 Texans, you also have to notify the Texas Attorney General no later than 30 days after that determination, using the Attorney General's data breach reporting form.
It doesn't create a new way to sue. The law says it doesn't create a private cause of action.
Why documentation is the whole game
The safe harbor puts the burden on the business. You have to demonstrate that the program existed and was being maintained when the breach happened. After an incident is the worst possible time to start gathering proof.
That means the paperwork matters as much as the technology. A good starting file includes:
A written information security policy that names the framework you follow.
An inventory of the devices, accounts and systems that hold sensitive data.
Your password and multifactor authentication policy, with proof it's enforced.
Employee cybersecurity training records with dates and attendance.
Patch and update records for computers, servers and network equipment.
Backup schedules and the results of restore tests.
Security monitoring records, such as alerts from a SIEM (a system that collects and reviews security logs) or an IDS/IPS (tools that detect and block suspicious network traffic).
A written incident response plan, plus notes from at least one practice run.
A yearly review date, so the program keeps up with framework updates.
A practical way to start
You don't have to tackle everything at once. A sensible order for most small businesses looks like this:
Know your size tier. Count employees and figure out which part of the law applies to you.
Find your sensitive data. List where Social Security numbers, account numbers and health information live, including email, file shares, line-of-business software and old laptops.
Pick a framework. For many offices with 20 to 99 people, CIS Controls IG1 is a natural fit because the law names it. Clinics and financial offices should line it up with their HIPAA or GLBA obligations.
Close the obvious gaps. Multifactor authentication on email and remote access, current patches, tested backups and staff training usually come first.
Write it down and review it. Keep the policy, the evidence and the review dates in one place.
If you work in healthcare or financial services, start with our pages on healthcare IT and HIPAA in Lubbock and financial services IT and cybersecurity, since your existing rules already shape what your program needs. For a broader planning conversation, our IT consulting services can help you map out where you are today and what to tackle first.
How Double Technologies can help
Double Technologies helps small and mid-size businesses across Lubbock and West Texas build cybersecurity programs that hold up, with real controls and the records to back them. Our team brings 30 years of combined experience, and our cybersecurity services in Lubbock include security monitoring with SIEM and IDS/IPS, multifactor authentication rollouts, backup testing and written policies matched to a recognized framework.
If you're not sure which part of SB 2610 applies to your business, or whether your current setup would hold up, call us at (806) 319-8521. We can come to you anywhere in Lubbock and the surrounding area. We're available Monday through Friday from 8 AM to 7 PM and Saturday from 9 AM to 5 PM Central.
This article is general information about Texas SB 2610 and isn't legal advice. Talk with your attorney about how the law applies to your business.
Comments