Austin Legislative Hub
Texas quietly changed what a lawsuit can cost a small business after a data breach. One ride, two ways to take it. Four Signals. Four minutes or twelve. Guided by Rex.
No class. No webinar. No slide deck. The curtain parts, the Meridian arrives, and it runs start to finish on its own — Rex reads you what the statute actually says in plain language, a film carries you between the stops, and you leave with the Library and a real question worth asking.
This Car provides educational orientation about Texas Senate Bill 2610 and Chapter 542, Business & Commerce Code. It is not legal advice, not a cybersecurity certification, and it does not determine whether any business would receive the protection the statute describes.
Founding ticket
Ticket activation
No account. No payment in Version 0.1. No forms, no funnel, no sales handoff. Activation starts the ride immediately — that is the whole promise of the Ticket.
How do you want this — Quick Start or Deep Dive?
About three minutes. Three bullets per stop: what changed, does it touch me, what a real program is, your next move. The punchline only — no statute read aloud.
Release 1 delivers Quick Start as four acts at the length on the button — measured in this build, not estimated. About 3 min per act (~12 min end to end) is the Release 2 editorial-depth target.
The full ride. Every line of Rex's narration, the on-screen citation cards for each section of Chapter 542, and the approved sources beside the player.
Release 1 delivers Deep Dive as the same four acts at the length on the button — measured in this build, not estimated. About 10 min per act at Deep (~40 min end to end) is the Release 2 editorial-depth target, not current delivery.
You are not locked in. A Quick / Deep switch rides with you in the player, so you can cross over at any stop.
Now boarding
Legislative Liner · SB 2610 Safe Harbor Car · Guided by Rex
What changed in Austin, and what the statute actually does.
2:23Whether Chapter 542 touches your business at all.
2:34What the statute says a qualifying program has to be.
2:54Your next move — and where the Library lives.
2:31Your ride depth
Audio-first. You can listen, read the transcript, or both. Rex is your only guide on this ride.
SB 2610 Safe Harbor Car · Rex
Educational orientation only. This Car does not provide legal advice, does not certify a cybersecurity program, and cannot tell you whether your business would receive the protection in Section 542.003.
Arrival
Everything Rex read to you lives here. Replay it, read it, or go to the source documents themselves.
Replay depth — same choice you made at the Ticket
Take the next step
Ten questions across five axes — Scope, Standard, Safeguards, Substantiation, Sustained. Rex's ride told you what the law does; the DIM tells you where your business stands and what to move first.
Board the DIM → Opens the private Safe Harbor DIM · gated access
Before you go
Optional. Email David, GRC Chair at Dynasty Stack, at david.m.williams@dynastyplays.com. Nothing is shared and no one contacts you unless you write first.
Email DavidFridays, standing session
David M. Williams · Dynasty GRC Chair
A live Friday session on what Chapter 542 asks of a Texas business, with room for the questions a recording cannot answer.
Fridays, 11:30–12:00 p.m. CDT · Rex + David · the best questions of the week · 30 minutes · 5-minute delay workflow. Friday is a secondary live option, not a reason to wait.
Right now
Rex holds the Chair's calendar
Do not wait for Friday. Pick the mornings that work and Rex takes it to the Chair, who confirms with you directly.
Rex facilitates the handoff to David. Scheduling is available anytime — Friday is a secondary live option, not a reason to wait.
Any stop, any time. Start over from Rex’s welcome, or replay Signal 01, 02, 03, or 04.
Four pages. What this is and is not, the statute in plain language, questions worth asking, and your next move.
Read instead of listen, or replay one stop. The transcript is the full narration, word for word, and it follows the audio.
David M. Williams, GRC Chair at Dynasty Stack, answers questions about this ride. Write if and when you want to: david.m.williams@dynastyplays.com. Nothing is sent unless you write.
Take the next step
SB 2610 Library
It is a plain-language orientation to Texas Senate Bill 2610, which added Chapter 542, "Cybersecurity Program," to the Texas Business & Commerce Code. Every factual statement here is traced to the enrolled bill text published by the Texas Legislature.
It is not legal advice. It is not a cybersecurity assessment, audit, or certification. It does not tell you whether your business is covered, whether your program conforms to any framework, or whether you would receive the protection the statute describes. Those determinations belong to a qualified Texas attorney and a qualified security professional who know your facts.
Who it is for: a Texas business owner or operator with fewer than 250 employees who keeps sensitive personal information on a computer — which is most of them.
The one sentence version: if a covered Texas business had a documented, framework-anchored, appropriately-scaled cybersecurity program in place at the time of a breach, a plaintiff harmed by that breach may not recover exemplary — punitive — damages from it.
| What | The statute |
|---|---|
| Passed | Senate 31–0 on April 30, 2025; House 109–27 on May 28, 2025. Signed June 20, 2025. |
| Effective | September 1, 2025. Applies only to a cause of action that accrues on or after that date. |
| Who it covers | A business entity in Texas that (1) has fewer than 250 employees and (2) owns or licenses computerized data including sensitive personal information — Sec. 542.002. |
| What it does | Bars recovery of exemplary damages in an action arising from a breach of system security, if the entity demonstrates it implemented and maintained a qualifying program at the time of the breach — Sec. 542.003. |
| What it does not do | It does not bar actual damages, does not remove breach-notification duties, does not create a private cause of action, and does not change any common law or statutory duty — Sec. 542.005. |
| Program must have | Administrative, technical, and physical safeguards; conformity with a named industry framework; and a design aimed at security, integrity, and preventing unauthorized access that creates material risk of identity theft or fraud — Sec. 542.004(a). |
| Scaled by headcount | Under 20: simplified, including password policies and appropriate employee training. 20–99: moderate, including CIS Controls Implementation Group 1. 100–249: full conformity with the framework list — Sec. 542.004(a)(4). |
| Named frameworks | NIST CSF; NIST 800-171; NIST 800-53 / 800-53a; FedRAMP; CIS Critical Security Controls; ISO/IEC 27000-series; HITRUST CSF; Secure Controls Framework; SOC 2; or other similar industry frameworks — any combination of current versions — Sec. 542.004(b)(1). |
| Regulated overlays | If subject to them: HIPAA, Title V Gramm-Leach-Bliley, FISMA 2014, HITECH. Plus PCI DSS where applicable — Sec. 542.004(b)(2)–(3). |
| Maintenance clock | When a listed standard is updated, the program keeps qualifying if updated by the later of the standard's published implementation date or the first anniversary of publication — Sec. 542.004(c). |
Two words carry the weight of the whole chapter: demonstrates — the burden sits with the business — and at the time of the breach — there is no cure period after an incident.
Bring these to your attorney, your security professional, your insurer, and your leadership team. They are prompts, not conclusions.
Replay any Signal, read every transcript, and go to the primary sources: the enrolled bill text, the committee substitute, the codified Chapter 542, and the bill history — all published by the Texas Legislature and Texas Statutes.
Some questions need a person. David M. Williams, GRC Chair at Dynasty Stack, answers questions about this ride at david.m.williams@dynastyplays.com. Optional, no pitch, no obligation. Nothing is sent unless you write.
Sources: S.B. No. 2610 enrolled text — capitol.texas.gov/tlodocs/89R/billtext/html/SB02610F.htm · Senate committee substitute — capitol.texas.gov/tlodocs/89R/billtext/html/SB02610S.htm · Business & Commerce Code Ch. 542 — statutes.capitol.texas.gov/Docs/BC/htm/BC.542.htm · Bill history — capitol.texas.gov/BillLookup/History.aspx?LegSess=89R&Bill=SB2610
Version 0.1 internal draft. Not published, not client-ready, not reviewed by counsel. Educational orientation only — not legal advice, not a certification, not a guarantee of protection.
The human layer
The Car taught you. The Library holds the substance. This is where a person picks it up.
Two ways in, and you never leave this page. Nothing here is a payment, a contract, or an obligation — it is a conversation with the person who does this work.
Optional. Email David, GRC Chair at Dynasty Stack, at david.m.williams@dynastyplays.com. Nothing is shared and no one contacts you unless you write first.
Email DavidFridays, standing session
David M. Williams · Dynasty GRC Chair
A live Friday session on what Chapter 542 actually asks of a Texas business, with room for the questions a recording cannot answer. Bring the question the ride produced.
Fridays, 11:30–12:00 p.m. CDT · Rex + David · the best questions of the week · 30 minutes · 5-minute delay workflow. Friday is a secondary live option, not a reason to wait.
Right now
Rex holds the Chair's calendar
Do not wait for Friday. Tell Rex what you need and pick the mornings that work — he takes it to the Chair and the Chair confirms with you directly.
Rex facilitates the handoff to David. Scheduling is available anytime — Friday is a secondary live option, not a reason to wait.