SB2121

Regular Session

Relating to the regulation of certain business entities that act as data brokers.

CriticalImmediate action required

Medium Cost

Effective:2025-09-01

Enforcing Agencies

Texas Attorney General

Compliance Analysis

Key implementation requirements and action items for compliance with this legislation

Implementation Timeline

Effective Date: September 1, 2025
Compliance Deadline: September 1, 2025. (You must be ready to register and have your security program in place on this date; there is no grace period).
Agency Rulemaking: While no specific rulemaking deadline is mandated, the Texas Attorney General is expected to issue guidance on enforcement priorities regarding "hybrid" business models in Q4 2025.

Immediate Action Plan

Conduct Data Inventory (Immediately): Audit your CRM and data lakes. Tag all records as "Direct" or "Third-Party."
Calculate Thresholds: Determine if you hold third-party data on >50,000 individuals. If yes, you are a Data Broker.
Gap Analysis: Compare your current information security program against the requirements of Chapter 509 (Business & Commerce Code).
Prepare Registration: Draft the Secretary of State filing to be submitted immediately upon the September 1, 2025 effective date.

Operational Changes Required

Contracts

Inbound Data Agreements: You must amend vendor contracts to include a "Source of Origin" warranty. You must be able to distinguish data you collected directly (exempt from the count) from data collected by a third party (counts toward the 50,000 threshold).
Outbound Data Licenses: If you sell or transfer data, your Master Services Agreements (MSAs) must be updated to reflect your status as a registered Data Broker, as clients may require this certification for their own compliance.
Service Provider DPAs: Clarify in Data Processing Agreements that vendors are processing on your behalf to avoid their actions being classified as a "sale" or "transfer" that contributes to revenue thresholds.

Hiring/Training

Security Program Officer: You must designate an employee responsible for the comprehensive information security program (WISP) mandated by Chapter 509.
Sales & Marketing Training: Teams must be trained to tag data sources in CRMs. They can no longer commingle "bought lists" with "organic leads" without tracking the provenance, as this affects your legal status.

Reporting & Record-Keeping

Data Provenance Logs: Implement a tracking system to separate "Directly Collected" data from "Third-Party" data. You must be able to prove to an auditor that you fall *under* the 50,000 individual threshold if challenged.
Secretary of State Registration: If the threshold is met, you must file the Data Broker registration form annually.
Security Assessments: You must document periodic vulnerability testing and risk assessments as part of your WISP.

Fees & Costs

Registration Fees: Budget for annual filing fees with the Secretary of State.
Compliance Costs: Expect "Medium" cost impact related to legal counsel for applicability analysis and IT costs for segregating data flows and upgrading security protocols to NIST-aligned standards.

Strategic Ambiguities & Considerations

Bundled Revenue Attribution: The law is vague on how to calculate the "50% of revenue" threshold for SaaS or bundled service contracts. If a contract includes both software access and a data feed, the AG has not clarified if the *entire* contract value counts as "data revenue."
Definition of "Processing": The statute defines processing broadly. It is unclear if mere storage of legacy third-party data (collected years ago) triggers the definition. A conservative reading suggests that holding accessible legacy data counts toward the 50,000 threshold.

Need Help Understanding Implementation?

Our government affairs experts can walk you through this bill's specific impact on your operations.

Schedule Consultation

Information presented is for general knowledge only and is provided without warranty, express or implied. Consult qualified government affairs professionals and legal counsel before making compliance decisions.

Legislative Timeline

This bill's path through the Texas Legislature

TopicsBusiness & Commerce Business & Commerce--general Protection of Personal Information

Official Analysis

View HRO Analysis View All Bill Documents

BILL ANALYSIS

Senate Research Center	S.B. 2121
89R15476 BCH-F	By: Johnson
	Business & Commerce
	3/27/2025
	As Filed

AUTHOR'S / SPONSOR'S STATEMENT OF INTENT

By request of the Office of the Texas Attorney General, S.B. 2121 would aim to rectify clerical errors in the data broker law and associated sections of code. The data broker law in the Texas Business and Commerce Code aimed to enforce consumer protections and increase transparency around data collection. In this statute, a "data broker" is defined as "a business entity whose principal source of revenue is derived from the collecting, processing, or transferring of personal data that the entity did not collect directly from the individual linked or linkable to the data." However, Section 509.003 of the Business & Commerce Code, which establishes the business entities the data broker law applies to, uses the term "data broker" instead of "business entity," and creates a discrepancy. Data brokers have attempted to use this textual discrepancy to argue that the data broker law does not apply to them, which harms consumers and decreases vital transparency measures.

S.B. 2121 would make a clerical change by replacing the term "data broker" with "business entity" or similar changes to conform the data broker law. This would make it so that the law applies to the intended companies and is applied as originally intended.

As proposed, S.B. 2121 amends current law relating to the regulation of certain business entities that act as data brokers.

RULEMAKING AUTHORITY

This bill does not expressly grant any additional rulemaking authority to a state officer, institution, or agency.

SECTION BY SECTION ANALYSIS

SECTION 1. Amends Section 509.003(a), Business & Commerce Code, as added by Chapter 963 (S.B. 2105), Acts of the 88th Legislature, Regular Session, 2023, as follows:

(a) Provides that, except as provided by Subsection (b) (relating to providing that certain provisions do not apply to certain entities), Chapter 509 (Definitions) applies only to a business entity, rather than a data broker, that, in a 12-month period, derives:

(1)-(2) makes conforming changes to these subdivisions.

SECTION 2. Provides that it is the intent of the 89th Legislature, Regular Session, 2025, that the amendments made by this Act to Section 509.003(a), Business & Commerce Code, as added by Chapter 963 (S.B. 2105), Acts of the 88th Legislature, Regular Session, 2023, be harmonized with another Act of the 89th Legislature, Regular Session, 2025, relating to nonsubstantive additions to and corrections in enacted codes.

SECTION 3. Effective date: September 1, 2025.

Senate Authors

Sen. Nathan JohnsonDemocrat · Primary Author

House Sponsor

Rep. Keith BellRepublican · Primary Sponsor

Bill Text(with markup)

S.B. No. 2121

View bill text in multiple formats on Texas Legislature website

Fiscal NoteView Original

	AN ACT
	relating to the regulation of certain business entities that act as
	data brokers.
	BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:
	SECTION 1. Section 509.001(4), Business & Commerce Code, as
	added by Chapter 963 (S.B. 2105), Acts of the 88th Legislature,
	Regular Session, 2023, is amended to read as follows:
	(4) "Data broker" means a business entity that
	collects, processes, or transfers [~~whose principal source of~~
	~~revenue is derived from the collecting, processing, or transferring~~
	of] personal data that the business entity did not collect directly
	from the individual linked or linkable to the data.
	SECTION 2. Section 509.003(a), Business & Commerce Code, as
	added by Chapter 963 (S.B. 2105), Acts of the 88th Legislature,
	Regular Session, 2023, is amended to read as follows:
	(a) Except as provided by Subsection (b), this chapter
	applies only to a data broker that, in a 12-month period, derives:
	(1) more than 50 percent of the data broker's revenue
	directly from processing or transferring personal data [~~that the~~
	~~data broker did~~] not collected by the data broker [~~collect~~]
	directly from the individuals to whom the data pertains; or
	(2) revenue directly from processing or transferring
	the personal data of more than 50,000 individuals [~~that the data~~
	~~broker did~~] not collected by the data broker [~~collect~~] directly
	from the individuals to whom the data pertains.
	SECTION 3. It is the intent of the 89th Legislature, Regular
	Session, 2025, that the amendments made by this Act be harmonized
	with another Act of the 89th Legislature, Regular Session, 2025,
	relating to nonsubstantive additions to and corrections in enacted
	codes.
	SECTION 4. This Act takes effect September 1, 2025.

LEGISLATIVE BUDGET BOARD
Austin, Texas

FISCAL NOTE, 89TH LEGISLATIVE REGULAR SESSION


April 9, 2025

TO:	Honorable Charles Schwertner, Chair, Senate Committee on Business & Commerce

FROM:	Jerry McGinty, Director, Legislative Budget Board

IN RE:	SB2121 by Johnson (Relating to the regulation of certain business entities that act as data brokers.), As Introduced

No fiscal implication to the State is anticipated.

Local Government Impact

No fiscal implication to units of local government is anticipated.

Source Agencies:

LBB Staff:

JMc, RStu, CMA

Related Legislation

Explore more bills from this author and on related topics

Frequently Asked Questions

Common questions about SB2121

What does Texas SB2121 do?

SB2121 fundamentally expands the scope of the Texas Data Broker Law by removing the "principal source of revenue" exemption. Effective September 1, 2025, any business—regardless of primary industry—that processes or transfers the personal data of more than 50,000 individuals (which it did not collect directly) is legally defined as a Data Broker. This reclassification triggers mandatory registration with the Secretary of State and strict information security requirements for retailers, fintechs, and marketing firms previously considered exempt.

Who authored SB2121?

SB2121 was authored by Texas Senator Nathan Johnson during the Regular Session.

When was SB2121 signed into law?

SB2121 was signed into law by Governor Greg Abbott on June 20, 2025.

Which agencies enforce SB2121?

SB2121 is enforced by Texas Attorney General.

How urgent is compliance with SB2121?

The compliance urgency for SB2121 is rated as "critical". Businesses and organizations should review the requirements and timeline to ensure timely compliance.

What is the cost impact of SB2121?

The cost impact of SB2121 is estimated as "medium". This may vary based on industry and implementation requirements.

What topics does SB2121 address?

SB2121 addresses topics including business & commerce, business & commerce--general and protection of personal information.

Legislative data provided by LegiScanLast updated: November 25, 2025

Need Strategic Guidance on This Bill?

Need help with Government Relations, Lobbying, or compliance? JD Key Consulting has the expertise you're looking for.