10 Things to Do After a Breach When Texas Gives You 60 Days to Notify

1. Write down the date, so both deadlines have a starting line you can prove

Every later step is measured from one date, and 3 weeks from now nobody will remember it the same way. The statute counts from the day the business determines the breach occurred. The Attorney General's reporting page describes the deadline as 30 days after discovery of the breach. Those can be different days, and the gap is a question for your attorney.

• Record who found the problem, what they saw, and the date and time.
• Record the date someone concluded that data was taken, and what that conclusion was based on.
• Give both dates and both wordings to counsel. CinchOps plans its technical work to the earlier date.

2. Preserve the evidence, so you can show what was and was not taken

The Texas duty depends on a definition. Section 521.053(a) defines a breach of system security as unauthorized acquisition of computerized data that compromises the security, confidentiality or integrity of sensitive personal information. Encrypted data counts if the person who took it has the key. Whether data was acquired is a forensic finding, and the proof lives on the machines you are tempted to wipe.

• Keep affected machines isolated and intact until someone qualified has imaged or examined them.
• Save firewall logs, Microsoft 365 or Google Workspace sign-in records, and backup snapshots from before and after the incident.
• Ask counsel whether the facts meet the statute's definition. Section 521.002 covers an unencrypted name combined with a Social Security number, a driver's license or government ID number, or an account or card number with its access code, plus information that identifies a person and relates to their health or health care.

3. Call your insurer and your attorney, so the calendar has an owner

2 outside parties change what you are allowed to do next. A cyber insurance policy carries its own notice clause, and the policy sets that deadline, so read it before you spend money on response. Your attorney decides how the Texas wording applies to your facts. Neither call should wait for the forensics to finish.

• Mark day 30 and day 60 on a shared calendar, counted from the date in step 1.
• Ask counsel whether a law enforcement agency has asked you to hold notice. Section 521.053(d) allows a delay when notice would impede a criminal investigation.
• Name one person inside the business who owns the notification file from here to the end.

4. Map what data lived on the affected systems, so the count is built on facts

You cannot count people until you know which files, mailboxes and databases the intruder could reach. This is the step that stalls. The pattern CinchOps sees in onboarding audits is that a business can name its servers and cannot say where the Social Security numbers and bank details are stored. A CPA practice in Sugar Land or a law firm in Katy holds exactly the records the Texas definition describes.

• List every account the intruder used and every mailbox, file share and application those accounts could open.
• Search those locations for the data types in Section 521.002: Social Security numbers, license and ID numbers, account and card numbers, and health information.
• Note where the evidence shows data left the network, and where it only shows access.

5. Count affected people and separate the Texas residents, so you know if 250 applies

The Attorney General's form asks for 2 numbers as of the day you file: how many Texas residents were affected, and how many have already been sent a disclosure by mail or another direct method. Letters to individuals have until day 60. The count behind them has to exist by day 30, which makes day 30 the real planning date.

• Build one list of affected people with a name, a last known address and a state for each.
• Total the Texas residents. At 250 or more, the Attorney General notice is required.
• For residents of other states, Section 521.053(b-1) allows notice under that state's law or under the Texas rule. Ask counsel which applies.

6. Tell the owner of the data immediately if the records are not yours

Some businesses hold sensitive records that belong to someone else. A bookkeeping firm that stores a client's payroll files is one example, and so is an IT or software vendor hosting customer data. Section 521.053(c) puts a faster duty on that business: notify the owner or license holder of the information immediately after discovering the breach.

• Sort the affected records into data you own or license and data you maintain for another business.
• Notify each owner right away, and check the contract between you for its own notice terms.
• Agree in writing on who sends the notices to individuals and who files with the Attorney General.

7. Draft the notices before you file, so the public record shows you told people

The "notice provided to consumers" field is public. A business that files on day 29 with no letters sent is reporting that fact on a page its customers can search. Section 521.053 sets the 30-day and 60-day limits separately, so the order is yours to choose with counsel. Having the notices drafted, approved and ready to mail when you file protects how the listing reads.

• Have counsel draft the notice letter while the count in step 5 is being finished.
• Pick the delivery method. Section 521.053(e) allows written notice to the last known address or electronic notice that meets 15 U.S.C. Section 7001.
• Check substitute notice only if it applies. Section 521.053(f) allows email, a conspicuous website posting, or statewide media when notice would cost more than $250,000, more than 500,000 people are affected, or contact information is insufficient.

8. File the Attorney General report by day 30 from a finished worksheet

The report is filed electronically through the Attorney General's website, and the Attorney General's page states that the system cannot save a report in progress. It has to be completed in one sitting by an authorized agent of the business, usually an owner, manager, officer or attorney. The page also warns that a completed report is potentially an open record.

• Preview the form first, and write the answers in a separate document before opening the live version.
• Prepare the 6 items Section 521.053(i) requires: the nature and circumstances of the breach, the number of Texas residents affected, the number already sent a disclosure, the measures taken, the measures planned, and whether law enforcement is investigating.
• Keep the confirmation email and the record number the Attorney General sends after submission.

9. Send notice to every affected person, so day 60 passes with nothing outstanding

60 days is an outer limit. The statute's first instruction is "without unreasonable delay," and the only exceptions it names are a law enforcement request and the time necessary to determine the scope of the breach and restore the integrity of the system. A business that waits until day 59 by habit is leaning on the limit and ignoring the instruction.

• Mail or send the notices as soon as the list and the letter are final, and keep proof of the send date.
• If you are notifying more than 10,000 people at one time, Section 521.053(h) also requires notice to each nationwide consumer reporting agency without unreasonable delay.
• Brief whoever answers the phone. Affected customers will call the main number.

10. Update the report and close the gap, so the listing reflects your finished work

Counts change as an investigation finishes. The Attorney General's page asks a business filing supplemental information to report the total number of affected and notified consumers to date and every type of personal information identified. Under Section 521.053(j), a notification comes off the public listing no later than its first anniversary if the business has reported no additional breaches in that period.

• File an updated report when the affected count or the notified count changes, so the public listing shows the current numbers.
• Fix the route the intruder used. A stolen password points to multi-factor authentication. Lost data points to backups you have restored from.
• Store the timeline, the count worksheet, the notices and the confirmation email together. Section 521.151 sets $2,000 to $50,000 per violation of the chapter, and that file is your record of what you did and when.