Texas SaaS Agreement Review
Texas runs its privacy law, breach rules and sales tax a little differently from everyone else. The Texas Data Privacy and Security Act, in force since July 1, 2024, has no consumer-count threshold, the attorney general must hear about large breaches within 30 days, and SaaS is taxed as a data processing service on 80% of the price. A Houston energy firm or an Austin startup should check all three in a software contract.
Consumer privacy law in Texas
Texas Data Privacy and Security Act (TDPSA)
No consumer-count threshold: it reaches any business operating in the state that is not a small business under the federal definition.
Data rights in Texas
Texas has enacted the Texas Data Privacy and Security Act (TDPSA), a comprehensive consumer privacy law. It gives residents rights over their personal data, typically access, correction, deletion, and the ability to opt out of the sale of data and targeted advertising, and generally requires vendors to sign a data-processing agreement. When you buy SaaS that will hold data about Texas residents, the vendor's terms should line up with those obligations.
The clauses that decide your risk
- Data use & AI training, is your data used only to provide the service, or to "improve" (train) the vendor’s models?
- Liability cap, often just one month of fees, against real data-loss exposure
- Auto-renewal, the cancellation-notice window (miss it and you renew for a year)
- Price increases, capped, or unilateral at renewal?
- Data export & deletion on termination, can you get your data out, and is it deleted?
- Uptime SLA and service credits
What processor terms does the TDPSA require?
Under Bus. & Com. Code 541.002, the act covers anyone doing business in Texas who processes or sells personal data and is not a small business under the SBA definition. Nonprofits, colleges, state agencies and HIPAA- or GLBA-regulated entities are exempt.
Section 541.104 requires a contract that sets out processing instructions, purpose, data types, duration and the parties' rights. The processor must bind its staff to confidentiality, delete or return data at the end of service, provide compliance information, allow reasonable assessments (or an independent assessor's report), and flow the same terms down to subcontractors in writing. The attorney general must give 30 days' notice and a chance to cure before suing under 541.154.
How fast must a Texas breach be reported?
Under Bus. & Com. Code 521.053, affected individuals must be notified without unreasonable delay and within 60 days of determining the breach occurred. If 250 or more Texans are involved, the attorney general must be notified through its online form within 30 days.
How is SaaS taxed in Texas?
The Comptroller generally treats SaaS as a data processing service, and Tax Code 151.351 exempts 20% of the value of data processing and information services. In practice, tax applies to 80% of the charge. Ask vendors to apply the exemption if their invoice taxes the full amount.
Texas sources checked 2026-10-09: Tex. Bus. & Com. Code 541.002 · Tex. Bus. & Com. Code 541.104 · Tex. Bus. & Com. Code 521.053 · Tex. Tax Code 151.351. Laws change; confirm the current rule before relying on it.
Texas SaaS agreement FAQ
Does Texas have a data privacy law that affects SaaS contracts?
Yes. Texas has enacted a comprehensive consumer privacy law, the Texas Data Privacy and Security Act (TDPSA). It gives residents rights over their personal data (such as access, deletion, and opting out of sale or targeted advertising) and generally requires a data-processing agreement, which shapes what a SaaS vendor can do with data about Texas residents. Note the scope: No consumer-count threshold: it reaches any business operating in the state that is not a small business under the federal definition.
Can a SaaS vendor use my Texas business's data to train AI?
Only if the contract lets them. Many SaaS agreements grant the vendor a right to use "customer data" to "improve the services," which can extend to training models. Regardless of Texas law, insist the contract says your data is never used to train shared or general-purpose models and is processed only to provide the service to you.
What should I check before signing a SaaS agreement in Texas?
The clauses that decide your risk: how your data can be used (and whether it trains AI), the liability cap versus your data-loss exposure, auto-renewal and the cancellation-notice window, unilateral price increases, and whether you can export and require deletion of your data on termination. ClauseAudit flags each against Texas law in about a minute.
Does the Texas privacy law apply to a mid-size company with few Texas customers?
It can. The TDPSA has no minimum number of consumers. If the company does business in Texas, processes personal data and is not a small business under SBA size standards, it is covered, and its SaaS vendors acting on its behalf must sign a contract meeting Section 541.104.
Why is sales tax on my Texas SaaS invoice lower than the full rate?
Because Texas taxes SaaS as a data processing service, and Tax Code 151.351 exempts 20% of the value of those services. Tax is due on the remaining 80% of the charge, at the state rate plus any local rate, so a $1,000 invoice is taxed on $800.
Reviewing a SaaS contract in Texas?
Upload it and get the data, liability, and renewal terms checked against Texas law in about a minute.
State privacy-law status summarized as of October 2026; this area changes quickly and thresholds and effective dates vary. This is automated educational information, not legal advice, ClauseAudit verifies current Texas law when you run your agreement, and you should confirm anything critical with a qualified attorney.