Frequently Asked Questions for Data Brokers
SOS Modernization ProgramIn Texas, data brokers are governed by Chapter 509 of the Business and Commerce Code and the secretary of state’s administrative rules found in 1 Texas Administrative Code Chapter 106, as well as any other applicable state or federal law.
What’s New!
We’ve added new features to our online Data Broker Registration system to improve your experience:
- Save draft feature: Easily save incomplete Data Broker registrations as drafts, allowing you to resume your work at your convenience within our system.
- Application Edit: In lieu of resubmitting from scratch, you now have the opportunity to revise any information necessary to rectify all objection reasons within 30 days of the objection.
What is a data broker?
A business entity whose principal source of revenue is derived from the collecting, processing, or transferring of personal data that the entity did not collect directly from the individual linked or linkable to the data.
Tex. Bus. & Com. Code § 509.001.
1. Are data brokers required to register with the Secretary of State?
Yes. Section 509.005 of the Business and Commerce Code provides that a data broker must register with the Secretary of State in order to conduct business in Texas. See Form 4001 (PDF). A data broker registers by filing a registration statement with Secretary of State, which must be accompanied by the $300 registration fee. The Secretary of State will issue a registration certificate upon filing a completed registration statement.
A registration certificate is effective for one year and may be renewed by filing a renewal application with and paying the $300 renewal fee to the Secretary of State.
2. Can the Secretary of State determine whether a specific data broker must register?
No. The Secretary of State cannot determine whether a particular data broker is required to register. Chapter 509 of the Business and Commerce Code contains important definitions; lists certain exemptions; provides guidelines for requirements related to registration, notice, and a comprehensive information security program; and sets filing fees. It is the data broker’s responsibility to determine whether the data broker should register with the Secretary of State.
3. If a data broker is registered with the Secretary of State, does that indicate agency approval of the data broker’s business?
No. The Secretary of State is the filing officer for data broker registration required by Chapter 509 of the Business and Commerce Code. Registration with the Secretary of State does not imply approval or endorsement of the data broker or its business activities.
4. What information is available concerning a data broker?
An individual can obtain information concerning a data broker that has filed a registration statement or renewal application, as applicable, with the Secretary of State by using our Data Broker Registry Search.
For each registered data broker, the registry will provide the following content required for a registration statement or renewal application, as specified by § 509.005 of the Business and Commerce Code:
- The data broker’s legal name and contact information;
- A description of the categories of data it processes and transfers;
- A statement regarding its implementation of a purchaser credentialing process;
- If the data broker has actual knowledge that it possesses personal data of a known child, certain statements detailing applicable use, opt-out policies, as well as compliance with federal and state law;
- Information related to the number of security breaches the data broker experienced in the prior year in which the registration or renewal is filed; and
- Any additional information the data broker chooses to provide regarding its data collection practices.
5. What if a data broker is not registered or engages in deceptive trade practices?
Under Chapter 509 of the Business and Commerce Code, a data broker that violates the registration or notice requirement is subject to a civil penalty up to $10,000 in a 12-month period. In addition, a violation by a data broker of the requirement to develop, implement, and maintain a comprehensive information security program constitutes a deceptive trade practice.
The Attorney General is authorized to bring an action against a data broker for a violation of Chapter 509 of the Business and Commerce Code. A person that believes a data broker is not registered as required or has otherwise committed a violation may file a complaint with the Attorney General’s Consumer Protection Division or contact that agency directly for additional information.
The Secretary of State is the filing officer for data broker registration and does not have the authority to regulate the business practices of a data broker, investigate alleged violations by the data broker, or enforce the requirements referenced above.
