Austin Legislative Hub
Texas quietly changed what a lawsuit can cost a small business after a data breach. One ride, two ways to take it. Four Signals. Four minutes or twelve. Guided by Rex.
No class. No webinar. No slide deck. The curtain parts, the Meridian arrives, and it runs start to finish on its own — Rex reads you what the statute actually says in plain language, a film carries you between the stops, and you leave with the Library and a real question worth asking.
This Car provides educational orientation about Texas Senate Bill 2610 and Chapter 542, Business & Commerce Code. It is not legal advice, not a cybersecurity certification, and it does not determine whether any business would receive the protection the statute describes.
Founding ticket
Ticket activation
No account. No payment at this stage. No forms, no funnel, no sales handoff. Activation starts the ride immediately — that is the whole promise of the Ticket.
Included with your ticket
Download the featured track on demand from your ticket.
How do you want this — Quick Start or Deep Dive?
About three minutes. Three bullets per stop: what changed, does it touch me, what a real program is, your next move. The punchline only — no statute read aloud.
The full ride. Every line of Rex's narration, the on-screen citation cards for each section of Chapter 542, and the approved sources beside the player.
You are not locked in. A Quick / Deep switch rides with you in the player, so you can cross over at any stop.
Now boarding
Legislative Liner · SB 2610 Safe Harbor Car · Guided by Rex
What changed in Austin, and what the statute actually does.
2:23Whether Chapter 542 touches your business at all.
2:34What the statute says a qualifying program has to be.
2:54Your next move — and where the Library lives.
2:31Your ride depth
Audio-first. You can listen, read the transcript, or both. Rex is your only guide on this ride.
SB 2610 Safe Harbor Car · Rex
Educational orientation only. This Car does not provide legal advice, does not certify a cybersecurity program, and cannot tell you whether your business would receive the protection in Section 542.003.
Arrival
Everything Rex read to you lives here. Replay it, read it, or go to the source documents themselves.
Replay depth — same choice you made at the Ticket
Before you go
Five ways forward, in order, and none of them is a funnel. Take the one that matches how much of this you want to carry yourself.
Decision mode
The Decision Intelligence Model
Go all the way to a decision. The DIM takes what the ride taught you and turns it into your tier, your framework choice, your gaps, and a dated record you can hand to counsel.
Board the DIM ▶Self-drive
You drive · Rex rides along
Keep the wheel. Rex stays with you, replays any Signal, and answers what his own narration already covers. Nothing scheduled, nothing assessed.
Human-in-the-loop
David M. Williams · Dynasty GRC Chair
A real person, on your schedule, not just on his. Tell Rex the shape of your question and he takes it to David, who confirms with you directly. The Friday live session is one way in, never the only one.
The Library
library.dynastyplays.com
The Car teaches one statute. Everything else Dynasty holds is in the Library, and it is one link away.
Visit the LibraryKeep riding
Next stop on the Legislative Liner
This car is one stop. The Liner keeps going, and your ticket carries you to the next one.
Any stop, any time. Start over from Rex’s welcome, or jump straight to the one you want.
Four pages. What this is and is not, the statute in plain language, questions worth asking, and your next move.
Read instead of listen, or replay one stop. The transcript is the full narration, word for word, and it follows the audio.
Everything that is not this statute lives there. One link, no detour.
The DIM for a decision, Rex to keep the wheel, or Human David anytime. The ride ends in a choice, not a pitch.
SB 2610 Library
It is a plain-language orientation to Texas Senate Bill 2610, which added Chapter 542, "Cybersecurity Program," to the Texas Business & Commerce Code. Every factual statement here is traced to the enrolled bill text published by the Texas Legislature.
It is not legal advice. It is not a cybersecurity assessment, audit, or certification. It does not tell you whether your business is covered, whether your program conforms to any framework, or whether you would receive the protection the statute describes. Those determinations belong to a qualified Texas attorney and a qualified security professional who know your facts.
Who it is for: a Texas business owner or operator with fewer than 250 employees who keeps sensitive personal information on a computer — which is most of them.
The one sentence version: if a covered Texas business had a documented, framework-anchored, appropriately-scaled cybersecurity program in place at the time of a breach, a plaintiff harmed by that breach may not recover exemplary — punitive — damages from it.
| What | The statute |
|---|---|
| Passed | Senate 31–0 on April 30, 2025; House 109–27 on May 28, 2025. Signed June 20, 2025. |
| Effective | September 1, 2025. Applies only to a cause of action that accrues on or after that date. |
| Who it covers | A business entity in Texas that (1) has fewer than 250 employees and (2) owns or licenses computerized data including sensitive personal information — Sec. 542.002. |
| What it does | Bars recovery of exemplary damages in an action arising from a breach of system security, if the entity demonstrates it implemented and maintained a qualifying program at the time of the breach — Sec. 542.003. |
| What it does not do | It does not bar actual damages, does not remove breach-notification duties, does not create a private cause of action, and does not change any common law or statutory duty — Sec. 542.005. |
| Program must have | Administrative, technical, and physical safeguards; conformity with a named industry framework; and a design aimed at security, integrity, and preventing unauthorized access that creates material risk of identity theft or fraud — Sec. 542.004(a). |
| Scaled by headcount | Under 20: simplified, including password policies and appropriate employee training. 20–99: moderate, including CIS Controls Implementation Group 1. 100–249: full conformity with the framework list — Sec. 542.004(a)(4). |
| Named frameworks | NIST CSF; NIST 800-171; NIST 800-53 / 800-53a; FedRAMP; CIS Critical Security Controls; ISO/IEC 27000-series; HITRUST CSF; Secure Controls Framework; SOC 2; or other similar industry frameworks — any combination of current versions — Sec. 542.004(b)(1). |
| Regulated overlays | If subject to them: HIPAA, Title V Gramm-Leach-Bliley, FISMA 2014, HITECH. Plus PCI DSS where applicable — Sec. 542.004(b)(2)–(3). |
| Maintenance clock | When a listed standard is updated, the program keeps qualifying if updated by the later of the standard's published implementation date or the first anniversary of publication — Sec. 542.004(c). |
Two words carry the weight of the whole chapter: demonstrates — the burden sits with the business — and at the time of the breach — there is no cure period after an incident.
Bring these to your attorney, your security professional, your insurer, and your leadership team. They are prompts, not conclusions.
Replay any Signal, read every transcript, and go to the primary sources: the enrolled bill text, the committee substitute, the codified Chapter 542, and the bill history — all published by the Texas Legislature and Texas Statutes.
Some questions need a person, and you should never have to wait for a particular day to ask one. Human David is reachable anytime — from the close, or from any stop on the ride. There is also a live session every Friday, which is one way in rather than the way in. No pitch, no obligation — bring the question the ride produced.
Sources: S.B. No. 2610 enrolled text — capitol.texas.gov/tlodocs/89R/billtext/html/SB02610F.htm · Senate committee substitute — capitol.texas.gov/tlodocs/89R/billtext/html/SB02610S.htm · Business & Commerce Code Ch. 542 — statutes.capitol.texas.gov/Docs/BC/htm/BC.542.htm · Bill history — capitol.texas.gov/BillLookup/History.aspx?LegSess=89R&Bill=SB2610
Educational orientation only. Not reviewed by counsel — not legal advice, not a certification, not a guarantee of protection.
The close
The Car taught you. This is where you decide how far you carry it.
Take the decision, keep the wheel, reach a person, visit the Library, or ride on to the next car. Nothing here is a funnel — the ride is finished either way, and you never leave this page unless you choose to.
Decision mode · DIM
The Decision Intelligence Model
Go all the way to a decision. The DIM turns what the ride taught you into your tier, your framework choice, your gaps, and a dated record you can hand to counsel and to your carrier.
Board the DIM ▶Self-drive · REX
You drive · Rex rides along
Nothing scheduled, nothing assessed. Rex replays any Signal, reads you the transcript, and answers what his own narration already covers. Come back here whenever the question gets bigger.
Human-in-the-loop · HITL
David M. Williams · Dynasty GRC Chair
Anytime means anytime. Tell Rex the shape of your question and the mornings that work, and he takes it to David, who confirms with you directly. There is also a live session every Friday — one way in, not the only one, and never something you have to wait for.
The Library
library.dynastyplays.com
One link, straight through. The Car stays a Car; the Library holds everything else.
Visit the LibraryKeep riding
Next stop on the Legislative Liner
Your ticket does not expire at the end of this car. The Liner keeps going.