(a) This chapter applies only to a person that:
(1) conducts business in this state or produces a product or service consumed by residents of this state;
(2) processes or engages in the sale of personal data; and
(3) is not a small business as defined by the United States Small Business Administration, except to the extent that § 541.107 applies to a person described by this subdivision.
(b) This chapter does not apply to:
(1) a state agency or a political subdivision of this state;
(2) a financial institution or data subject to Title V, Gramm-Leach-Bliley Act (15 U.S.C. § 6801 et seq.);
(3) a covered entity or business associate governed by the privacy, security, and breach notification rules issued by the United States Department of Health and Human Services, 45 C.F.R. Parts 160 and 164, established under the Health Insurance Portability and Accountability Act of 1996 (42 U.S.C. § 1320d et seq.), and the Health Information Technology for Economic and Clinical Health Act (Division A, Title XIII, and Division B, Title IV, Pub. L. No. 111-5);
(4) a nonprofit organization;
(5) an institution of higher education; or
(6) an electric utility, a power generation company, or a retail electric provider, as those terms are defined by § 31.002, Utilities Code.

Text of section effective on July 01, 2024