A data breach is expensive on its own. A lawsuit that follows it can be worse, especially if a jury awards exemplary damages, the Texas term for punitive damages meant to punish rather than repay.
Texas Senate Bill 2610, passed in 2025, gives smaller Texas businesses a way to take that risk off the table. If a business with fewer than 250 employees can show it had a qualifying cybersecurity program in place when a breach happened, the people suing it cannot recover exemplary damages. The law took effect September 1, 2025, and adds Chapter 542 to the Texas Business and Commerce Code.
It is a meaningful incentive, but it only helps businesses that do the work before a breach and can prove it afterward.
Who SB 2610 applies to
The law applies to a business entity in Texas that:
- has fewer than 250 employees, and
- owns or licenses computerized data that includes sensitive personal information, the same category of data covered by the Texas breach notification law (for example, a name combined with a Social Security number, driver's license number, financial account details or health information).
Most small and midsize Texas employers meet both tests, because employee and customer records alone usually include sensitive personal information.
What the safe harbor does, and doesn't do
What it does. In a lawsuit arising from a breach of system security, a person harmed by the breach may not recover exemplary damages from a covered business if the business demonstrates that, at the time of the breach, it had implemented and maintained a cybersecurity program that meets the law's requirements.
What it doesn't do. SB 2610 is a limit on one kind of damages, not immunity:
- It does not prevent a lawsuit or bar claims for actual losses.
- It does not change the duty to notify affected individuals within 60 days, or the Texas Attorney General within 30 days when 250 or more Texans are affected. Our Texas data breach response guide covers those deadlines.
- It does not create a new right to sue, or change other legal duties a business already has.
- It applies only to claims that arose on or after September 1, 2025.
What counts as a qualifying cybersecurity program
The program must include administrative, technical and physical safeguards to protect personal and sensitive personal information, and it must conform to an industry-recognized cybersecurity framework. The bill lists recognized frameworks, including the NIST Cybersecurity Framework, NIST Special Publication 800-171, the CIS Critical Security Controls and SOC 2. It also points to HIPAA security requirements for businesses already subject to them, and PCI DSS for businesses that handle payment cards.
The law scales the requirements to the size of the business:
- Fewer than 20 employees: simplified requirements, including password policies and appropriate employee cybersecurity training.
- 20 to 99 employees: moderate requirements, including the CIS Controls Implementation Group 1 safeguards.
- 100 to 249 employees: full conformance with one of the recognized frameworks.
Frameworks change over time. The law lets a business keep its protection when a listed framework is updated, as long as it updates its program within the window the law allows. A program built once and never revisited may stop qualifying.
The catch: you have to prove it
The safe harbor depends on what the business can demonstrate about its security on the day of the breach. A business that says it follows a framework but has no written program, no records and no evidence of training will have a hard time using it. Documentation is what turns good security into legal protection.
Simple steps to qualify for the SB 2610 safe harbor
- Confirm the law applies. Count employees and list where sensitive personal information lives: payroll, HR files, customer records, email, file shares and cloud apps.
- Pick your tier and framework. For many businesses with 20 to 99 employees, CIS Controls IG1 is the clearest starting point. Larger firms may choose the NIST Cybersecurity Framework or the full CIS Controls.
- Run a gap assessment. Compare what is actually in place today against the framework. Our cybersecurity assessment guide explains how.
- Write the program down. Put policies, responsibilities and safeguards in a written cybersecurity program approved by leadership.
- Cover the basics first. Password policy and multi-factor authentication, security awareness training, patching, endpoint protection, tested backups and access controls.
- Keep dated evidence. Save training records, policy versions, configuration reports, assessment results and backup tests, so you can show what was in place on any given date.
- Review at least once a year. Update the program when the business changes or when the framework you follow publishes a new version.
- Bring in your attorney and insurer. Ask your attorney how the safe harbor applies to your business, and share your program with your cyber insurer, which often expects the same controls.
Where to start
Start by naming the framework you will follow and writing down what is already in place. For most small and midsize businesses, the gap between "we do most of this" and "we can prove it" is smaller than it looks, and closing it improves security whether or not a lawsuit ever comes.
Our Texas cybersecurity compliance guide puts SB 2610 alongside other Texas and federal requirements, and our article on cyber insurance and compliance covers what insurers expect. This article is general information, not legal advice; talk with your attorney about your specific obligations.
HUFF DATA SYSTEMS helps Texas businesses build cybersecurity programs on recognized frameworks such as the CIS Controls, and keep the documentation to show it. If you would like help preparing for SB 2610, talk with our team.
Sources
- S.B. 2610, 89th Legislature, enrolled version, Texas Legislature
- Bill analysis for S.B. 2610, enrolled version, Senate Research Center
- Bill history for S.B. 2610, Texas Legislature Online
- Texas Identity Theft Enforcement and Protection Act (Business & Commerce Code Chapter 521), Texas Legislature
- CIS Controls Implementation Groups, Center for Internet Security
- Cybersecurity Framework, NIST