Your Customer Sent a Texas Data Processing Addendum. What Does Texas Law Require It to Say?

A business customer's procurement team sends your SaaS company a data processing addendum, and one section is headed "Texas." It lists terms your company must accept as the customer's processor. Your team wants to know which of those terms Texas law actually requires, and which are the customer's own requests.

This post is for founders and operations leads at software companies that handle personal data for business customers. It sets out what the Texas Data Privacy and Security Act says a contract between a controller and a processor must include, what else the Act asks of a processor, and the questions to settle before signing. It is general information about one statute and contract practice, not an assessment of whether the Act applies to your company or whether any particular addendum complies.

The short answer

The Texas Data Privacy and Security Act requires a contract between a controller and a processor to govern the processor's data processing procedures for processing performed on the controller's behalf, and it lists what that contract must include.¹ A Texas section in a customer's addendum often tracks that list. A term beyond that list is not an express contract requirement of section 541.104(b), but it may address another duty under the Act or another applicable law. Distinguish those legal requirements from additional protections the customer is requesting.

Who is a controller and who is a processor

The Act defines a "controller" as a person that, alone or jointly with others, determines the purpose and means of processing personal data, and a "processor" as a person that processes personal data on behalf of a controller.² Whether a company is acting as a controller or a processor for a specific processing activity is, in the Act's words, "a fact-based determination that depends on the context in which personal data is to be processed," and a processor that continues to adhere to a controller's instructions for that processing remains a processor.¹

A SaaS company can be a processor for the data its customers put into the product and a controller for its own account, billing and marketing data. Our post on enterprise SaaS contracts, MSAs and DPAs covers how the addendum sits alongside the main agreement.

The Act applies only to a person that conducts business in Texas or produces a product or service consumed by Texas residents, processes or sells personal data, and is not a small business as defined by the United States Small Business Administration, subject to the exception identified in section 541.002(a)(3); it also excludes several categories of entity and data.³ The Act's definition of "consumer" excludes an individual acting in a commercial or employment context.² Selling software to businesses does not, by itself, resolve applicability: the processing may involve those businesses' consumers rather than only their employees or business contacts. Whether it applies to your company, or to your customer, is a question for your own facts.

What the contract must include

Section 541.104(b) says the contract must include:¹

1. Clear instructions for processing data.
2. The nature and purpose of processing.
3. The type of data subject to processing.
4. The duration of processing.
5. The rights and obligations of both parties.
6. A requirement that the processor meet the five conditions below.

The five conditions are that the processor:

• ensure that each person processing personal data is subject to a duty of confidentiality with respect to the data;
• at the controller's direction, delete or return all personal data to the controller as requested after the provision of the service is completed, unless retention is required by law;
• make available to the controller, on reasonable request, all information in the processor's possession necessary to demonstrate the processor's compliance with the Act;
• allow, and cooperate with, reasonable assessments by the controller or the controller's designated assessor; and
• engage any subcontractor under a written contract that requires the subcontractor to meet the processor's requirements with respect to the personal data.

Two of those items deserve a second look when you read a customer's draft.

Assessments. As an alternative to the assessments described in section 541.104(b)(6)(D), a processor may arrange for a qualified and independent assessor to assess its policies and technical and organizational measures in support of the Act's requirements, using an appropriate and accepted control standard or framework and assessment procedure. The processor must provide a report of that assessment to the controller on request.¹ If your company already has an independent assessment report, check whether the customer's draft allows you to offer it.

Subcontractors. The written-contract requirement applies to subcontractors engaged to process the personal data, which may include hosting and AI model providers, depending on the service and data flows.¹ Our post on AI subprocessors and customer contract obligations covers how those upstream terms meet the promises you make downstream.

What else the Act asks of a processor

Section 541.104(a) also requires a processor to adhere to the controller's instructions and to assist the controller in meeting its duties under the Act, including:¹

• assisting with consumer rights requests, by appropriate technical and organizational measures, as reasonably practicable;
• assisting with the security of processing personal data, including, if applicable, personal data collected, stored and processed by an artificial intelligence system as defined in Section 551.001, and with notification of a breach of security of the processor's system under Chapter 521; and
• providing necessary information to enable the controller to conduct and document data protection assessments.

The consumer-rights and security/breach-notification assistance duties take into account the nature of processing and the information available to the processor. The Act also says that section 541.104 does not relieve a controller or a processor from the liabilities imposed on it by virtue of its role in the processing relationship.¹ Our posts on who notifies the customer after a vendor security incident and the Texas AI law for private companies cover the neighboring questions.

Who enforces it

The Texas attorney general has exclusive authority to enforce the Act.⁴ Before bringing an action, the attorney general must notify the person in writing, at least 30 days before, identifying the specific provisions alleged to be violated, and may not bring the action if the person cures the identified violation within that period and provides the written statement the Act describes.⁵

Reading the customer's Texas section

These are questions for your contract review, not conclusions about any particular addendum:

1. Does the draft identify which processing it covers, with the instructions, nature and purpose, data types and duration the Act lists?
2. Does it describe both parties' rights and obligations, or only yours?
3. Does the deletion-or-return term follow the controller's direction and allow retention required by law?
4. Does the assessment clause preserve the qualified, independent-assessor alternative in section 541.104(c), including the duty to provide the assessment report on request, and distinguish that alternative from reasonable assessments by the controller or its designated assessor?
5. Does each subcontractor that processes the personal data—including any AI or hosting provider acting in that role—have a written contract requiring it to meet your processor requirements with respect to that data?
6. Which terms go beyond section 541.104, such as fixed notice deadlines, audit frequency, liability caps or indemnities, and are those terms you can keep? Our post on security questionnaire answers that drift into commitments covers how operational promises become contract terms.
7. Is the Texas section consistent with the California and other state sections in the same addendum? Our posts on California privacy policies for SaaS and the CCPA's automated decision rules for SaaS vendors cover the California side.

What this post does not cover

This post does not say whether the Act applies to any company, whether any company is a controller or a processor for any processing, or whether any addendum complies. It does not cover a controller's own duties, consumer rights in detail, sensitive data, data protection assessments, penalties, or other states' privacy laws. Our post on customer contract terms for AI products covers the wider set of clauses in the main agreement.

How we can help

Accord & Shield Legal reviews and negotiates data processing addenda and customer contracts, and drafts privacy policies and related terms, for technology companies in Arizona, California and Texas. To better understand the scope of your matter, you can schedule an initial consultation. The consultation is evaluation-only; no legal advice is provided. Representation begins only after an engagement agreement is signed and any required retainer is received. Please do not send confidential or sensitive documents before we confirm that we can assist.

---

This article is general information, not legal advice. Reading it does not create an attorney-client relationship. Whether the Texas Data Privacy and Security Act applies, and what a particular contract must say, depends on your facts; consult an attorney about your situation.