Austin Legislative Hub
Your business may be small. Your data trail is not. What you collect, where it goes, which vendors and AI tools touch it, and who answers when a person asks. One page. Fifteen minutes. Same rail, same fare, no gate.
No class. No webinar. No slide deck. The Car runs start to finish on its own — four Signals, a pressure door between each one, and the complete signed Car waiting in the Library.
Educational orientation only. Not legal advice — the statute is quoted here so you can read it yourself, but applicability findings belong to counsel and to David M. Williams's GRC practice. This Car ends with a blank page and a pen: the decision is yours.
This ride
Ride depth
No account, no form, no sales handoff. The ride starts the moment you board — four Signals, a pressure door between each one, and the Library at the end.
How do you want this — Quick Start or Deep Dive?
The owner orientation. Three bullets per Signal — the punchline of each stop and nothing else. Enough to make the decision this Car asks you to make.
Release 1 delivers Quick Start as four acts at the length on the button — measured in this build, not estimated. About 3 min per act (~12 min end to end) is the Release 2 editorial-depth target.
Every line of this Car's approved text, in order, with the founder's notes as cards beside it. Narrated by Rex, with the read-along measured from his recordings.
Release 1 delivers Deep Dive as the same four acts at the length on the button — measured in this build, not estimated. That length is measured from Rex’s recordings in this build. About 10 min per act at Deep (~40 min end to end) is the Release 2 editorial-depth target, not current delivery.
You are not locked in. The Quick / Deep switch rides with you in the player, so you can cross over at any stop. The complete original Car — worksheet, red lines, correction log and all — is always one tap away under “Full Reading + Sources”.
Now boarding
State Liner · Car 04 — Data Privacy & Security · Guided by Rex
Your business may be small. Your data trail is not — and the owner is the one who has to know it.
1:20Privacy is not fundamentally a legal-document problem. It is an operations problem wearing a legal coat.
2:02AI is not arriving as one big enterprise project. It is entering through a dozen small doors.
2:10Your advantage is a short, living record — not a perfect policy binder.
1:10Your ride depth
Audio-first rider: Rex narrates this Car, and the transcript highlights sentence by sentence from his recordings.
Car 04 · Data Privacy & Security · Rex
Statute quotations on this Car were taken from the code's own text on 2026-09-11 and are quoted, not paraphrased, with section numbers so you can check every one. Whether a chapter applies to your business is a legal finding, not a claim this Car makes.
Educational orientation only. Not legal advice — the statute is quoted here so you can read it yourself, but applicability findings belong to counsel and to David M. Williams's GRC practice. This Car ends with a blank page and a pen: the decision is yours.
This is Car 04 exactly as it was signed — every word of the approved doctrine, the worksheet, the red lines, the boundaries, and the correction log, unabridged and unedited. The rider above is a second way through the same words, not a replacement for them.
State Liner · Car 04
Your business may be small. Your data trail is not. What you collect, where it goes, which vendors and AI tools touch it, and who answers when a person asks. One page. Fifteen minutes. Same rail, same fare, no gate.
v1 doctrine · corrections signed and dated in the log below.
You may think of privacy as something large technology companies worry about. But the moment your business collects a job application, a payroll record, a benefits enrollment, a customer contact, a website form, a text message, a health-related note, or an AI-assisted conversation, information starts moving through systems you do not fully control. This Car is the owner’s data trail: what you collect, where it goes, which vendors and AI tools touch it, and who answers when a person asks. One page. Fifteen minutes. Same rail, same fare, no gate.
Your payroll provider, benefits platform, CRM, email suite, outsourced HR partner, website forms, accountant, cybersecurity vendor, AI meeting tool, and marketing software may each touch a different part of the same person’s story. The owner does not need to be a data scientist to own the risk. The owner needs to know the trail.
Could you draw the path of your employee and customer data — from collection to vendor to AI tool to archive — without guessing?
The Meridian move on this stop is a register, not a program. Start a Data Trail Register with seven columns: data collected, business purpose, system of record, vendor or processor, sensitive-data status, retention practice, and accountable owner. One page. No software required. The blank version is at the bottom of this Car.
The upside-down truth is that privacy is not fundamentally a legal-document problem. It is an operations problem wearing a legal coat.
A vendor says its platform is compliant. A website generator hands you a privacy policy. An AI tool says your conversations are secure. Your managed IT provider says encryption is on. Each of those statements may be partly true — and not one of them answers whether your business can explain its own data practices.
The Texas Data Privacy and Security Act — House Bill 4, codified as Chapter 541 of the Business & Commerce Code — gives Texas consumers rights over their personal data and places obligations on the businesses the chapter covers. The applicability test is where small employers get careless, because being small is where the analysis starts, not where it ends.
“This chapter applies only to a person that … is not a small business as defined by the United States Small Business Administration, except to the extent that Section 541.107 applies to a person described by this subdivision.” — Tex. Bus. & Com. Code § 541.002(a)(3)
“A person described by Section 541.002(a)(3) may not engage in the sale of personal data that is sensitive data without receiving prior consent from the consumer.” — § 541.107(a)
Read those two sentences together. The small-business status that keeps most of Chapter 541 off your desk does not cover the sale of sensitive personal data — that consent duty follows you anyway. And the SBA definition of a small business varies by industry, sometimes by revenue and sometimes by headcount, so “we are small” is a finding somebody has to make, not an assumption you get to keep.
When a customer asks what information you have, where it came from, or who you shared it with — does someone in your company know the answer?
The Meridian move here is a name, not a department. Assign one accountable Data Steward: a named human responsible for keeping the map current and routing requests when they arrive.
AI is not arriving as one big enterprise project. It is entering through a dozen small doors: email drafting, applicant screening, customer chat, meeting notes, marketing content, claims support, coding help, spreadsheet analysis, and vendor platforms you already pay for.
Federal policy may encourage innovation at speed, but Texas is building its own accountability rails around artificial intelligence. The Texas Responsible Artificial Intelligence Governance Act — House Bill 149 — added Subtitle D to Title 11 of the Business & Commerce Code: Chapter 551 general provisions, Chapter 552 artificial intelligence protection, Chapter 553 the regulatory sandbox program, and Chapter 554 the Texas Artificial Intelligence Council. Chapter 551 took effect January 1, 2026.
“‘Artificial intelligence system’ means any machine-based system that, for any explicit or implicit objective, infers from the inputs the system receives how to generate outputs, including content, decisions, predictions, or recommendations, that can influence physical or virtual environments.” — § 551.001
That definition is wide enough to reach the meeting-notes tool somebody switched on last quarter without telling you. The subtitle’s own applicability section reaches a person who promotes, advertises, or conducts business in this state, or who produces a product or service used by residents of this state — which describes almost every business riding this rail.
It also draws a line worth knowing before you assume the statute is about your employees: a consumer under this subtitle is an individual who is a resident of this state acting only in an individual or household context, and the term does not include an individual acting in a commercial or employment context (§ 551.001). The AI tool pointed at your applicants and the AI tool pointed at your customers are not the same question, and the honest answer is that both belong to counsel.
Which AI tools can your people use, what information can they enter, and who is allowed to turn a pilot into a business process?
The Meridian move is a gate, not a ban. Create an AI Use Gate with four fields: approved tool, permitted data, prohibited data, and responsible business owner. Nothing about it forbids the work. It records the decision.
Your advantage is not a perfect policy binder. It is a short, living record that proves you see the data, understand the vendors, and control the AI doors.
At the end of this Car, you should be able to say five things out loud without checking with anyone:
The Meridian lesson on this Car is a working session, not a lecture. Build the one-page Data Trail Register and the AI Use Gate, then name the first unresolved vendor or data flow — the one you could not fill in without guessing. That single blank is your next decision, and it is worth more than a binder.
Now that you can see what moves through your business, the next question is unavoidable: what happens when something goes wrong? Car 05 is the incident Car — Chapter 521’s duties, the first hour after the call, and the evidence a small employer can actually produce.
This Car is educational orientation. It is not legal advice, not a compliance determination, and not an opinion about your business. Whether Chapter 541 reaches you turns on the SBA small-business definition for your industry and on what your business does with sensitive data. Whether the AI subtitle’s duties reach a particular use of a particular tool is a legal question about that tool and that use.
This Car will not tell you that you are covered, that you are exempt, or that a vendor’s contract is sufficient. Applicability findings belong to counsel — David M. Williams’s GRC practice is one door to that, and the DIM tells you where you stand before you spend a dollar.
Statute quotations on this Car were taken from the code’s own text on 2026-09-11 and are quoted, not paraphrased. Section numbers are given so you can check every one of them.
Take the next step
Arrival
Everything this Car says lives here. Replay any Signal, read the whole Car unabridged, or take the next step.
Replay depth — same choice you made at the Ticket
Any stop, any time. Start over from the top of Car 04.
Read instead of listen, or replay one stop. The transcript is the Car's own text, word for word, and it follows along.
The complete signed Car — doctrine, worksheet, red lines, boundaries, and the correction log. Nothing abridged.
David M. Williams, GRC Chair at Dynasty Stack, answers questions about this ride. Write if and when you want to: david.m.williams@dynastyplays.com. Nothing is sent unless you write.
Questions about this ride
Optional and up to you. Email David, GRC Chair at Dynasty Stack, at david.m.williams@dynastyplays.com. Nothing is shared and no one contacts you unless you write first.
Take the next step
Meridian Rail · State Liner · Car 04 · v1 · 2026-09-11