Relating to a limitation on civil liability of business entities in connection with a breach of system security.

Added an employee count threshold of fewer than 250 employees to determine which businesses qualify for the cybersecurity program safe harbor protection.

Changed the cybersecurity program requirements to include tiered standards based on employee count: simplified requirements for fewer than 20 employees, moderate requirements for 20-99 employees, and full compliance for 100-249 employees.

Modified the cybersecurity framework update requirement to allow updates within the later of the standard's implementation date or the first anniversary of publication, replacing the original 180-day deadline.

Added a new effective date of September 1, 2025, and a provision stating the chapter applies only to causes of action accruing on or after that date.

Added a new definition for 'exemplary damages' referencing Section 41.001 of the Civil Practice and Remedies Code.

Changed the safe harbor provision to prohibit recovery of exemplary damages for breaches if the entity demonstrates compliance with the cybersecurity program requirements.