Texas SB 2610 Explained: How a Written Security Program Takes Punitive Damages Off the Table

The protection, and its limits

The law creates a new chapter in the Texas Business & Commerce Code. Under it, a court may not award exemplary damages (punitive damages) against a business in a lawsuit arising from a data breach, provided the business maintained a compliant written cybersecurity program before the breach occurred.

Be clear on what that leaves in place. You can still be sued. You are still responsible for actual, compensatory damages. The law removes only the punitive layer, which is the part of a judgment intended to punish and which is added on top of real damages. For a small or mid-sized business that layer often decides whether the company recovers from an incident or shuts down.

It works as an affirmative defense that has to be built ahead of time. A program put together after the breach does not qualify you to raise it.

Which businesses qualify, and what each size must do

The safe harbor is available to Texas businesses with fewer than 250 employees that handle sensitive personal information. The obligations grow with the size of the business. A firm of fifteen people is not expected to run the security program of a large enterprise.

• 100 to 249 employees. Implement a recognized framework, such as the NIST Cybersecurity Framework , NIST SP 800-171 or 800-53, the CIS Controls, or the ISO/IEC 27000 series.
• 20 to 99 employees. Adopt the CIS Controls Implementation Group 1 (IG1), a defined set of basic safeguards widely regarded as cyber hygiene.
• Fewer than 20 employees. The simplified tier: documented password policies and ongoing cybersecurity training for staff.

Regulated businesses get a shorter path. If you already comply with HIPAA, the Gramm-Leach-Bliley Act, PCI DSS, or ISO/IEC 27001 , you are treated as meeting the framework requirement. A medical practice, a CPA firm, or any other business under one of those regimes has much of the work behind it already, as long as that compliance is real, documented, and maintained.

There is a condition attached to all of this. The program has to be scaled to fit your business, and it has to be in place and kept up. A binder of policies that no one follows is not a compliant program and will not stand up as a defense.

What this changes for a smaller company

Small and mid-sized businesses get attacked because they tend to hold valuable data behind lighter defenses. We are not saying that to frighten anyone. It is the reason SMBs appear in the breach reports every year.

SB 2610 shifts part of that picture. Until now, security work paid off only by lowering risk. In Texas it now also produces a documented legal shield for the day something goes wrong.

Texas is the fifth state to offer a safe harbor of this kind, and more are following the pattern. Businesses that take it up as an opportunity, and do not file it with the things they mean to get to someday, end up ahead on security and on liability.

Where Defendrs comes in

No product purchase gets you into the safe harbor. You qualify by building and maintaining a program that maps to one of the recognized standards, and by being able to prove you did. That is the center of our managed cybersecurity work:

• Measure where you are today against the framework that matches your size.
• Fix what is missing, which usually means MFA, email security, endpoint detection, access controls, and backups.
• Write and maintain the policies and documentation that show the program exists.
• Keep it current, since the safe harbor protects you only if the program was real and maintained at the time of the breach.

For a Texas business with fewer than 250 employees, the sensible first move is to learn which tier you are in and how far your current setup is from meeting it.

Find out where you stand. Answer a few questions and you will see which SB 2610 tier applies to you and where the gaps are. It takes about three minutes.

→ Check your exposure · Book a consultation

This article provides general information and is not legal advice. Consult qualified counsel about how SB 2610 applies to your specific situation.