Agentix Data Solutions
Menu

Texas Data Broker and Privacy Laws for Real Estate Data Users

Everyone · Updated 2026-10-16

Texas Data Broker and Privacy Laws for Real Estate Data Users

Information, not legal advice. Laws change; check the current statute or rule and talk to a Texas attorney before you act.

Real estate investors, tax lenders and the vendors who serve them handle a lot of information about people: owner names, mailing addresses, court filings and, often, phone numbers and emails from skip tracing. Texas has three laws that matter here:

The key idea in all three is the same. Facts lawfully taken from government records are treated differently from contact data bought from a vendor.

1. The Texas data broker law (Business & Commerce Code ch. 509)

Texas passed its data broker law in 2023 (SB 2105). In 2025, SB 2121 and SB 1343 widened and amended it, effective September 1, 2025.

Who is a data broker. After the 2025 changes, it is a business entity that collects, processes or transfers personal data it did not collect directly from the individual. The old requirement that this be the company's "principal source of revenue" was removed.

When the chapter applies. In a 12-month period, either of these triggers it (§509.003(a), as amended):

The public-records exclusion. In chapter 509, "personal data" does not include "publicly available information." That term covers information lawfully made available through government records, information reasonably believed to be lawfully available through widely distributed media, and information the consumer made public. Deidentified data is also excluded.

What a covered broker must do:

What this means for property data. A file built only from appraisal rolls, tax rolls and court indexes is largely "publicly available information." Once a business adds phone numbers and emails bought from a skip-trace vendor, it is handling personal data it didn't collect directly. At volume, that can make it a data broker. Get a lawyer's read on your own setup. Registration is cheap compared with the penalty.

2. The Texas Data Privacy and Security Act (Business & Commerce Code ch. 541)

The TDPSA took effect July 1, 2024.

Who it covers (§541.002). A person that:

Even a small business may not sell sensitive personal data without the consumer's prior consent (§541.107).

What counts as personal data. Information linked or reasonably linkable to an identified or identifiable individual. Publicly available information, including government records, is excluded (§541.001).

Consumer rights. Covered businesses must honor requests to:

They also need a privacy notice. A business that sells personal data must say so.

Enforcement. The Attorney General enforces the act. There is no private lawsuit right under it, and the act provides a notice-and-cure period before an enforcement action.

What this means for property data. Public-record facts generally fall outside "personal data." Appended phones and emails are personal data, so access, deletion and opt-out rights can attach to them.

3. The Texas breach notice law (Business & Commerce Code ch. 521)

If you keep sensitive personal information and it is breached (§521.053):

"Sensitive personal information" includes a name combined with items such as a Social Security number, driver's license number, or financial account number with its access code. A plain owner-and-address list generally isn't covered, but customer payment data, logins and skip-trace files may be.

4. Federal rules that come with contact data

If your contact data comes from regulated sources, federal rules follow it:

Ask each vendor where its data comes from and what uses its license allows.

5. Privacy rules built into Texas public records

Some protections sit inside the records themselves. Respect them even when another source would let you work around them.

A short checklist

  1. Map your data: which fields came from government records, and which came from vendors?
  2. If you add vendor contact data at volume, check ch. 509 registration and the website notice.
  3. Check whether the TDPSA applies to you, and build a way to handle access, deletion and opt-out requests.
  4. Keep a written security program, and know your 60-day and 30-day breach deadlines.
  5. Read your vendors' license terms on use and resale.
  6. Never re-identify owners whose records are legally hidden.

How this shows up in Agentix Data

Agentix Data builds its files from government records: appraisal rolls, tax rolls, court indexes, city code cases and posted sale notices. We don't append phone numbers or emails. We don't re-identify owners with confidential addresses under Tax Code §25.025, and we don't carry utility account data or protective-order, juvenile or guardianship cases.

Sources

General information, not legal or financial advice.