ShareAndGoShareAndGo

Data breach notification

Texas data breach notification law

Texas sets its breach rule in Tex. Bus. & Com. Code § 521.053, part of the Identity Theft Enforcement and Protection Act.

It gives individuals a 60-day outer limit and the attorney general a 30-day one.

The two Texas clocks

IndividualsAttorney general
DeadlineWithout unreasonable delay and not later than the 60th day after the person determines the breach occurredAs soon as practicable and not later than the 30th day after that determination
Applies whenSensitive personal information was or is reasonably believed to have been acquiredThe breach involves at least 250 Texas residents

The attorney general's notice is filed through an electronic form on the attorney general's website.

Both clocks run from the date "on which the person determines that the breach occurred", not from the date of the intrusion.

Sensitive personal information

Texas uses the label sensitive personal information: "an individual's first name or first initial and last name in combination with any one or more of the following items, if the name and the items are not encrypted."

The items are a Social Security number, a driver's license or government ID number, and an account or card number with any required code or password.

A second branch covers health data: "information that identifies an individual and relates to: (i) the physical or mental health or condition of the individual; (ii) the provision of health care to the individual; or (iii) payment for the provision of health care to the individual."

No harm test; encryption and the key

Section 521.053 has no risk-of-harm exception.

Encryption helps only while the key stays safe. A breach includes "data that is encrypted if the person accessing the data has the key required to decrypt the data."

Where ShareAndGo fits

Houston and Dallas firms routinely send patient billing files, ID scans and account details to outside reviewers.

For documents you share through ShareAndGo, the activity log records every view and download, and watermarked view-only pages carry the reader's email address and the date.

The watermark is a per-room setting, on by default. Reviewers enter with a six-digit code sent to their email and need no account. Each group sees only its folders, and the chained log exports as CSV for a fast answer about which files someone opened inside ShareAndGo.

Texas FAQ

How many Texans before the attorney general is told?
At least 250 residents of Texas.
Does medical billing information count?
Yes. Information that identifies a person and relates to payment for the provision of health care to them is covered.
Is there an exception where harm is unlikely?
No. Section 521.053 has no risk-of-harm exception.
When does the 60-day period start?
On the date the person determines that the breach occurred.
Is a breach of encrypted files reportable?
Only where the person accessing the data has the key required to decrypt it.

Checked

Checked against Texas's published law on November 2, 2026. This is general information, not legal advice.

Elsewhere on ShareAndGo

Breach notification laws by state

Breach notification laws by jurisdiction.

ShareAndGo vs DataRooms.com

ShareAndGo compared with DataRooms.com.

ShareAndGo home

Home.