Good security can now be legal protection, not just good practice.
Texas now gives businesses a legal shield if they've adopted a recognized cybersecurity framework and still get breached anyway. This is general information, not legal advice, but it's worth understanding what's on the table.
Quick answer
Texas SB 2610, in effect since September 1, 2025, gives businesses with fewer than 250 employees an affirmative defense against exemplary (punitive) damages in a data breach lawsuit, as long as they maintained a cybersecurity program that met their size tier's requirements when the breach happened. It doesn't block compensatory damages, regulatory fines, or Texas Attorney General enforcement.
What is Texas SB 2610?
Senate Bill 2610 shields qualifying businesses with fewer than 250 employees from exemplary (punitive) damages in a data breach lawsuit, provided they maintain a cybersecurity program scaled to their size. It doesn't eliminate liability entirely, but it takes the largest damages exposure off the table.
Who qualifies, and what does each tier need?
SB 2610 applies to Texas businesses under 250 employees that own or license computerized data containing sensitive personal information. What you need to show scales with your headcount:
| Your employee count | What you need to qualify |
|---|---|
| Fewer than 20 employees | A written password policy and cybersecurity training for staff |
| 20–99 employees | CIS Critical Security Controls, Implementation Group 1 |
| 100–249 employees | NIST Cybersecurity Framework or the HITRUST Common Security Framework |
| Any size, already compliant | Existing HIPAA, GLBA, or PCI-DSS compliance also satisfies the law |
Want the deeper dive? Read safemode IT's full breakdown: Texas SB 2610: The New Cybersecurity Safe Harbor Law Every Business Owner Must Know.
What protection do you actually get?
Qualifying under SB 2610 is an affirmative defense against one specific kind of exposure: exemplary (punitive) damages in a civil data breach lawsuit. It's not blanket immunity. Compensatory damages, regulatory fines, and Texas Attorney General enforcement all still apply regardless of whether you qualify. Your separate breach notification duties (below) aren't affected either.
This is general information, not legal advice
Safe harbor laws are specific and evolving. Talk to a licensed attorney about how SB 2610 applies to your specific business before relying on it.
Frequently asked questions about Texas SB 2610
What is Texas SB 2610?
Texas SB 2610 is a state law, in effect since September 1, 2025, that gives qualifying Texas businesses an affirmative defense against exemplary (punitive) damages in a data breach lawsuit. To use it, you need to have maintained a cybersecurity program that met your size tier's requirements at the time of the breach.
Who does Texas SB 2610 apply to?
Texas businesses with fewer than 250 employees that own or license computerized data containing sensitive personal information: Social Security numbers, government ID numbers, financial account credentials, or health information. Businesses with 250 or more employees aren't covered.
Does SB 2610 mean I can't be sued after a data breach?
No. It doesn't block a lawsuit or eliminate liability. It takes exemplary (punitive) damages off the table if you qualify. Compensatory damages, regulatory fines, and Texas Attorney General enforcement aren't affected.
What do I actually need to have in place to qualify?
It depends on your employee count. Fewer than 20 employees: a written password policy and cybersecurity training for staff. 20 to 99 employees: the CIS Critical Security Controls, Implementation Group 1. 100 to 249 employees: the NIST Cybersecurity Framework or the HITRUST Common Security Framework. Existing HIPAA, GLBA, or PCI-DSS compliance also satisfies the law.
When do I need to have this in place?
SB 2610 has been in effect since September 1, 2025. What matters is whether you maintained a qualifying program at the time of the breach, not whether you put one together afterward. The sooner it's documented, the stronger your position.
Is compliance self-certified, or does someone verify it?
There's no state agency that certifies you in advance. You need documented proof: written policies, training records, and evidence the framework is actually followed, not just adopted on paper. That documentation is what you'd rely on if you ever needed to invoke the safe harbor.
Does having cyber insurance still matter if I qualify for the safe harbor?
Yes. The safe harbor addresses one kind of legal exposure: punitive damages in a lawsuit. It doesn't cover incident response costs, ransom payments, business interruption, regulatory fines, or compensatory damages. Cyber insurance is built to cover those.
Does SB 2610 replace my breach notification obligations?
No, those are separate. Texas law still requires notifying affected individuals within 60 days of discovering a breach, and notifying the Texas Attorney General within 30 days if 250 or more Texas residents are affected. See our Compliance Resources page for the full breakdown.
Get a free look at your safe harbor readiness.
We'll help you see which tier of SB 2610 applies to your business and what's left to put in place.