What the Texas Data Privacy and Security Act Means for Texas Businesses

What the Texas Data Privacy and Security Act Means for Texas Businesses

The Texas Data Privacy and Security Act (TDPSA) took effect on July 1, 2024, and it is now actively enforced. The law establishes clear consumer privacy rights and requires businesses to be more transparent, secure, and accountable in how they handle personal data.

---

Why the TDPSA Matters

• Regulates how personal data is collected, used, and protected, not just breaches

• Applies to many businesses without a revenue threshold

• Aligns Texas with other major state privacy laws

• Enforcement activity is already underway

---

Who Must Comply

The TDPSA generally applies to organizations that:

• Do business in Texas or

• Provide products or services to Texas residents and

• Collect, use, share, or process personal data

Some exemptions apply, but many mid-sized businesses are covered.

---

Consumer Rights Under the TDPSA

Texas residents now have the right to:

• Know what personal data is collected and why

• Access and obtain a copy of their data

• Correct inaccurate personal data

• Request deletion of personal data

• Opt out of targeted advertising, data sales, and certain profiling

As of January 1, 2025, consumers may use an authorized agent to submit opt-out requests.

---

Business Obligations (At a Glance)

Businesses subject to the TDPSA must:

• Publish a clear and accurate privacy notice

• Collect only data that is necessary and relevant

• Obtain affirmative consent for sensitive personal data

• Implement reasonable administrative, technical, and physical security safeguards

• Provide a process to respond to consumer requests within required timeframes

• Maintain proper data processing agreements with vendors

---

Enforcement and Penalties

• Enforced exclusively by the Texas Attorney General

• No private lawsuits under the TDPSA

• 30-day cure period may apply

• Civil penalties can reach up to $7,500 per violation

---

Practical Compliance Steps

To reduce risk, Texas businesses should:

• Inventory the personal data they collect and store

• Review and update privacy and security policies

• Strengthen cybersecurity controls (access, backups, monitoring)

• Train employees on data handling and privacy requests

• Confirm vendors meet security and privacy obligations

---

Final Takeaway

The TDPSA makes data privacy a core business responsibility in Texas. Organizations that take a proactive, operational approach to privacy and security will be better positioned to avoid enforcement issues and build customer trust.

---

Disclosure

This article is for informational purposes only and does not constitute legal advice.
Consult qualified legal counsel for guidance specific to your business and industry.

---

Need help aligning your IT and security practices with Texas privacy requirements?

Visit www.bitxbit.com or call 877.860.5831 to start the conversation.

Sources & References

1. Texas Office of the Attorney General – Texas Data Privacy and Security Act (TDPSA)
   https://www.texasattorneygeneral.gov/consumer-protection/file-consumer-complaint/consumer-privacy-rights/texas-data-privacy-and-security-act

2. Texas Business & Commerce Code, Chapter 541 – Texas Data Privacy and Security Act
   https://statutes.capitol.texas.gov/Docs/BC/htm/BC.541.htm

3. Texas State Law Library – Overview of the Texas Data Privacy and Security Act
   https://www.sll.texas.gov/spotlight/2024/07/texas-data-privacy-and-security-act/

4. Fisher Phillips – FAQs for Businesses on the Texas Data Privacy Law
   https://www.fisherphillips.com/en/news-insights/faqs-businesses-texas-data-privacy-law.html

5. TrustArc – Texas Data Privacy and Security Act Compliance Summary
   https://trustarc.com/regulations/texas-tdpsa/

6. Didomi – TDPSA Requirements and Sensitive Data Consent
   https://www.didomi.io/blog/texas-data-privacy-law-tdpsa-everything-you-need-to-know-didomi

7. Ketch – Business Compliance Obligations Under the TDPSA
   https://www.ketch.com/regulatory-compliance/texas-data-privacy-security-act-tdpsa

---

Disclaimer

Sources are provided for general informational purposes only and do not constitute legal advice.

🚨 Scam Alert: When a “Quick Question” on LinkedIn Isn’t What It Seems

🚨 Scam Alert: When a “Quick Question” on LinkedIn Isn’t What It Seems

I recently received a message on LinkedIn that, at first glance, felt harmless—maybe even professional. While I suspected it might be a scam, I decided to follow the conversation just far enough to understand what the scam was and how it worked.

What unfolded is a pattern more people should recognize.

How It Started: The Hook

The message was simple:

“Hey, can I ask you a quick question?”

No pitch. No links. Just curiosity.

I replied politely and asked how I could help. They followed up with a general question about my business—nothing technical, nothing sensitive. We exchanged a few messages. Everything still felt reasonable.

That’s intentional.

Scammers don’t start with scams. They start with rapport.

The Shift: From Professional to Personal

After a short back-and-forth, the tone changed:

“I really like you. I’d like to become closer friends.”

That’s when my guard went up. In professional settings—especially unsolicited ones—early emotional language without context is a red flag. Legitimate business conversations don’t usually pivot to personal closeness this quickly.

Still, I stayed neutral and continued observing.

The Real Goal: Moving Off the Platform

Soon after came the real ask:

“What’s the best way to stay in touch—WhatsApp or Signal?”

This is a critical moment in many modern scams.

Messaging apps aren’t the problem—the timing is. Scammers push conversations off professional platforms because:

• There’s less moderation and oversight

• No easy reporting trail

• Encrypted, private communication

• More room for long-term manipulation

I declined and responded clearly that I preferred to keep communication inside LinkedIn Messenger and that I was happy to discuss anything business-related there.

The Confirmation

About an hour later, the profile disappeared.

Either the account was deleted or LinkedIn detected suspicious behavior and removed it. Either way, the outcome confirmed what the pattern already suggested: this was not a legitimate connection.

Why This Is Dangerous (Without the Tech Jargon)

This wasn’t malware. There were no links. No obvious phishing attempt.

That’s what makes it dangerous.

This type of interaction is called social engineering—attacks that target people instead of systems. Once moved off-platform, these conversations often evolve into:

• Fake investment or crypto opportunities

• Business partnership scams

• Credential harvesting

• Executive or vendor impersonation

• Requests for favors, files, or introductions

• Financial or identity theft

The goal is simple: build trust first, exploit later.

Red Flags to Watch For

Be cautious when you see several of these together:

• Vague openers like “quick question”

• Early compliments or emotional language

• Interest in you more than your business

• Requests to move to WhatsApp, Signal, or Telegram

• No clear professional objective

• New or “too perfect” profiles

• Sudden disappearance after you set boundaries

What to Do If This Happens to You

If you encounter something like this, keep it simple:

1. Stay professional and topic-driven

2. Don’t move off the platform early

3. Set a clear boundary

   “If there’s something business-related, feel free to share it here.”

4. Watch what happens next—disappearance is often your answer

5. Report and block the profile

6. Educate your team—these scams target employees at all levels

Firewalls don’t stop social engineering. Awareness does.

Why This Matters for Businesses

What starts as a casual LinkedIn message can turn into:

• Financial fraud

• Account compromise

• Wire-transfer scams

• Reputational damage

Modern cybersecurity isn’t just about tools—it’s about people, process, and awareness.

---

How Bit by Bit Can Help

At Bit by Bit Computer Consulting, we help organizations defend against the threats that don’t look like threats—until it’s too late.

We work with businesses to:

• Train teams to recognize real-world social engineering

• Strengthen security beyond basic software

• Monitor suspicious activity and account compromise

• Build practical, human-aware security programs

If you’d like help strengthening your organization’s security posture—or just want a second set of eyes on your current approach—we’re here to help.

👉 www.bitxbit.com
📞 877.860.5831

IRS Email Scams Are Back — Here’s How to Spot Them Before It’s Too Lat

If you’ve recently received an email claiming “You Have a New Notification in Your Online Account” and saying it’s from the Internal Revenue Service, you’re not alone.

These messages are circulating again—and they’re designed to look just legitimate enough to make people click.

Unfortunately, that click is exactly what scammers are hoping for.

---

Why This Email Looks Real (But Isn’t)

The email usually includes:

• Official-sounding language

• References to privacy policies

• Instructions to “sign in” to view an urgent notice

At a glance, it feels routine. That’s intentional.

Scammers rely on familiarity and urgency, not technical complexity. If they can make the message feel normal, they increase the odds that someone reacts instead of thinking.

---

The Biggest Red Flag: The IRS Doesn’t Work This Way

Here’s the most important thing to know:

The IRS does not initiate contact with taxpayers by email.

They don’t send unsolicited emails asking you to:

• Log in to your account

• View notices

• Update personal information

• Resolve issues urgently

Initial IRS contact is made by U.S. mail, not email, text message, or social media.

If an email claims otherwise, that alone is enough to treat it as suspicious.

---

Other Warning Signs to Watch For

These scam emails often include multiple red flags:

Generic greetings

“Dear Taxpayer” is used because scammers don’t know your name. Legitimate IRS correspondence almost always does.

Embedded login links

The goal is to send you to a fake IRS-looking website that captures your username and password.

Urgency without specifics

Phrases like “view immediately” or “new notification” are meant to rush you—without explaining what the issue actually is.

---

What Happens If You Click

Once credentials are stolen, attackers can:

• Access tax records

• File fraudulent returns

• Redirect refunds

• Use your identity for additional financial fraud

For businesses, one compromised user can lead to:

• Email account takeovers

• Payroll or W-2 fraud

• Broader network access

This is why phishing remains one of the most effective attack methods today.

---

What You Should Do Instead

If you receive an email like this:

✔ Do not click any links
✔ Do not reply
✔ Do not download attachments

The safe way to check:

1. Open your browser

2. Manually type IRS.gov

3. Log in directly from the official site

If there’s a real notice, it will be waiting for you there.

---

Report It (It Actually Helps)

You can help stop these scams by forwarding the email as an attachment to:

phishing@irs.gov

After reporting it, delete the message.

---

Final Takeaway

If an email pressures you to act quickly and asks you to “sign in now,” slow down.

The IRS will never rush you by email.
Scammers will.

A few extra seconds of caution can save months—or years—of cleanup.

---

How Bit by Bit Can Help

Phishing emails like this are exactly why Bit by Bit Computer Consulting focuses on more than just technology—we focus on prevention.

We help organizations:

• Train employees to recognize phishing and social engineering

• Secure email systems against impersonation and spoofing

• Implement layered security that limits damage if someone clicks

• Monitor for compromised accounts and unusual activity

• Respond quickly when something doesn’t look right

If you’re unsure whether your current setup would catch or contain an attack like this, it’s worth a quick conversation.

📞 Call: 877.860.5831
🌐 Visit: www.bitxbit.com

A short review today can prevent a costly incident tomorrow.