Texas data breach notification rules for insurance agencies
By Tyler Mayberry · Cirlet. Published . Page updated .
A summary of public law and regulator guidance for independent agencies, checked October 28, 2026. It is not legal advice. Read the linked source and ask your counsel or the regulator how it applies to your agency.
Texas has not adopted the NAIC Insurance Data Security Model Law. Its general breach law still applies to agencies: notify affected individuals within 60 days of determining that a breach occurred, and the Attorney General within 30 days when at least 250 Texans are affected.
The rules at a glance
| General breach notice (any business) | “Without unreasonable delay and in each case not later than the 60th day after the date on which the person determines that the breach occurred” (Tex. Bus. & Com. Code § 521.053(b)). |
|---|---|
| Notice to the Attorney General | “As soon as practicable and not later than the 30th day” after determining the breach occurred, if it involves at least 250 Texas residents. Submitted through the form on the Attorney General’s website (§ 521.053(i)). |
| Latest amendment | S.B. 768, effective September 1, 2023 |
NAIC model law: Not adopted. The NAIC does not show Texas as adopting its Insurance Data Security Model Law (status as of October 8, 2026). Other Texas insurance privacy rules can still apply.
Texas agencies’ public email records
In our October 2026 check of 65 Texas independent agency website domains, 54 (83%) published one SPF record, 30 (46%) published a DMARC record and 13 (20%) asked receivers to quarantine or reject mail that fails. Public records show what a domain asks of receivers. They do not show whether an agency’s accounts or inboxes are protected.
What to prepare now
- Write down who decides that a cybersecurity event has occurred, and who files the notice, with a backup person.
- Keep the regulator’s notice route and the deadline above where you can reach them when email is unavailable.
- Ask your IT provider for evidence of multi-factor authentication on email and agency systems, and a list of everyone with administrator access.
- List the vendors that hold client information and how each will tell you about an incident.
Rehearse losing email access · Prepare for email fraud
Texas questions
Does Texas have an insurance data security law like Missouri’s or Ohio’s?
Not the NAIC model law. As of October 8, 2026 the NAIC does not show Texas as adopting it. Texas’s general breach notification law in Business and Commerce Code § 521.053 applies to agencies like any other business.
How long does a Texas agency have to notify affected people?
Without unreasonable delay, and no later than 60 days after determining the breach occurred (§ 521.053(b)).
When must a Texas agency notify the Attorney General?
When a breach involves at least 250 Texas residents: as soon as practicable and no later than 30 days after determining it occurred, using the Attorney General’s online form (§ 521.053(i)).
Sources
- Texas Business and Commerce Code § 521.053
- § 521.053 text and amendment history (Public.Law)
- NAIC Model #668 adoption map, status as of October 8, 2026
Other states: Missouri · Ohio · New York · California · All state pages