JD Key Consulting Logo
Signed Into Law
Signed June 20, 2025Effective 2025-09-01
SB2121

Regular Session

Relating to the regulation of certain business entities that act as data brokers.

Government Affairs & Regulatory Compliance Analysis

SB2121: Government Affairs Overview

SB2121 fundamentally expands the scope of the Texas Data Broker Law by removing the "principal source of revenue" exemption. Effective September 1, 2025, any business—regardless of primary industry—that processes or transfers the personal data of more than 50,000 individuals (which it did not collect directly) is legally defined as a Data Broker. This reclassification triggers mandatory registration with the Secretary of State and strict information security requirements for retailers, fintechs, and marketing firms previously considered exempt.

Sen. Nathan Johnson·Senate Bill·Regular Session

Critical
Medium Cost
Effective:2025-09-01
Enforcing Agencies

Texas Attorney General

Business Impact

Who SB2121 Affects

This legislation has regulatory implications for the following Texas businesses and organizations:

Regulatory Priority: critical

Significant regulatory changes (effective 2025-09-01). Review with your legal and compliance teams to understand implications.

🏭

Manufacturing & Business

Affected business types:

  • Manufacturers
  • Industrial facilities
  • Supply chain companies
  • Logistics providers
View all manufacturing & business legislation

Key Operational Considerations

  • 1Security Program Officer: You must designate an employee responsible for the comprehensive information security program (WISP) mandated by Chapter 509.

Estimated Cost Impact

mediumModerate costs expected for implementation.

Need Government Relations Support?

JD Key Consulting provides government affairs and regulatory strategy services. We help businesses navigate Texas agencies, understand legislative impacts, and advocate for their interests.

Need Help Navigating This Legislation?

JD Key Consulting provides strategic guidance on Texas regulatory compliance and legislative impact for your business.

SB2121
Critical
Relating to the regulation of certain business entities that act as data brokers.
Critical Compliance Urgency
Requires immediate attention
Cost Impact
Medium
Effective
2025-09-01
Enforcing Agencies
Texas Attorney General
Primary Author: Sen. Nathan Johnson
89th Texas Legislature
jdkey.com
01

Compliance Analysis

Key implementation requirements and action items for compliance with this legislation

Implementation Timeline

  • Effective Date: September 1, 2025
  • Compliance Deadline: September 1, 2025. (You must be ready to register and have your security program in place on this date; there is no grace period).
  • Agency Rulemaking: While no specific rulemaking deadline is mandated, the Texas Attorney General is expected to issue guidance on enforcement priorities regarding "hybrid" business models in Q4 2025.

Immediate Action Plan

  • Conduct Data Inventory (Immediately): Audit your CRM and data lakes. Tag all records as "Direct" or "Third-Party."
  • Calculate Thresholds: Determine if you hold third-party data on >50,000 individuals. If yes, you are a Data Broker.
  • Gap Analysis: Compare your current information security program against the requirements of Chapter 509 (Business & Commerce Code).
  • Prepare Registration: Draft the Secretary of State filing to be submitted immediately upon the September 1, 2025 effective date.

Operational Changes Required

Contracts

  • Inbound Data Agreements: You must amend vendor contracts to include a "Source of Origin" warranty. You must be able to distinguish data you collected directly (exempt from the count) from data collected by a third party (counts toward the 50,000 threshold).
  • Outbound Data Licenses: If you sell or transfer data, your Master Services Agreements (MSAs) must be updated to reflect your status as a registered Data Broker, as clients may require this certification for their own compliance.
  • Service Provider DPAs: Clarify in Data Processing Agreements that vendors are processing on your behalf to avoid their actions being classified as a "sale" or "transfer" that contributes to revenue thresholds.

Hiring/Training

  • Security Program Officer: You must designate an employee responsible for the comprehensive information security program (WISP) mandated by Chapter 509.
  • Sales & Marketing Training: Teams must be trained to tag data sources in CRMs. They can no longer commingle "bought lists" with "organic leads" without tracking the provenance, as this affects your legal status.

Reporting & Record-Keeping

  • Data Provenance Logs: Implement a tracking system to separate "Directly Collected" data from "Third-Party" data. You must be able to prove to an auditor that you fall *under* the 50,000 individual threshold if challenged.
  • Secretary of State Registration: If the threshold is met, you must file the Data Broker registration form annually.
  • Security Assessments: You must document periodic vulnerability testing and risk assessments as part of your WISP.

Fees & Costs

  • Registration Fees: Budget for annual filing fees with the Secretary of State.
  • Compliance Costs: Expect "Medium" cost impact related to legal counsel for applicability analysis and IT costs for segregating data flows and upgrading security protocols to NIST-aligned standards.

Strategic Ambiguities & Considerations

  • Bundled Revenue Attribution: The law is vague on how to calculate the "50% of revenue" threshold for SaaS or bundled service contracts. If a contract includes both software access and a data feed, the AG has not clarified if the *entire* contract value counts as "data revenue."
  • Definition of "Processing": The statute defines processing broadly. It is unclear if mere storage of legacy third-party data (collected years ago) triggers the definition. A conservative reading suggests that holding accessible legacy data counts toward the 50,000 threshold.

Need Compliance Guidance on This Legislation?

JD Key Consulting specializes in Texas regulatory compliance strategy. Work directly with James Dickey—former Chairman of the Republican Party of Texas—to understand this bill's impact on your operations and develop an actionable compliance plan.

Schedule a Consultation

Information presented is for general knowledge only and is provided without warranty, express or implied. Consult qualified government affairs professionals and legal counsel before making compliance decisions.

02

Legislative Timeline

This bill's path through the Texas Legislature

Filed
Mar 10, 2025
Passed Senate
Apr 24, 2025
Passed House
May 28, 2025
Signed
Jun 20, 2025
Effective
Sep 1, 2025
TopicsBusiness & CommerceBusiness & Commerce--generalProtection of Personal Information
03

Senate Authors

Sen. Nathan JohnsonDemocrat · Primary Author

House Sponsor

Rep. Keith BellRepublican · Primary Sponsor

Bill Text(with markup)

View bill text in multiple formats on Texas Legislature website

Fiscal NoteView Original

Related Legislation

Explore more bills from this author and on related topics

More from Sen. Nathan Johnson

View all bills by Sen. Nathan Johnson

Related by Topic

View more Business & Commerce legislation
Quick Reference

Frequently Asked Questions

Common questions about SB2121

Q

What does Texas SB2121 do?

SB2121 fundamentally expands the scope of the Texas Data Broker Law by removing the "principal source of revenue" exemption. Effective September 1, 2025, any business—regardless of primary industry—that processes or transfers the personal data of more than 50,000 individuals (which it did not collect directly) is legally defined as a Data Broker. This reclassification triggers mandatory registration with the Secretary of State and strict information security requirements for retailers, fintechs, and marketing firms previously considered exempt.

Q

Who authored SB2121?

SB2121 was authored by Texas Senator Nathan Johnson during the Regular Session.

Q

When was SB2121 signed into law?

SB2121 was signed into law by Governor Greg Abbott on June 20, 2025.

Q

Which agencies enforce SB2121?

SB2121 is enforced by Texas Attorney General.

Q

How significant are the changes in SB2121?

The regulatory priority for SB2121 is rated as "critical". Businesses and organizations should review the legislation to understand potential impacts.

Q

What is the cost impact of SB2121?

The cost impact of SB2121 is estimated as "medium". This may vary based on industry and implementation requirements.

Q

What topics does SB2121 address?

SB2121 addresses topics including business & commerce, business & commerce--general and protection of personal information.

Q

What are the key dates for SB2121?

Key dates for SB2121: Effective date is 2025-09-01. Consult with legal counsel regarding applicability.

Q

Which Texas businesses are affected by SB2121?

SB2121 primarily affects Texas businesses and commercial enterprises. These businesses should review the legislation with their legal and compliance teams to understand potential impacts.

Need Strategic Guidance on This Legislation?

JD Key Consulting is an Austin, Texas-based government affairs firm led by James Dickey, former Chairman of the Republican Party of Texas. We specialize in Texas regulatory compliance and legislative strategy for data centers, energy, banking, and manufacturing.

Legislative data provided by LegiScanLast updated: January 11, 2026