SB 2097 would exempt employed peace officers (state or local) from tuition and lab fees at Texas public colleges when enrolled in specific degree programs. It directly affects current or future peace officers seeking degrees in fields like criminal justice, forensic science, nursing, cybersecurity, or law enforcement-related studies. The exemption requires students to maintain satisfactory academic progress and apply at least one week before registration. The policy change takes effect for the 2025 fall semester, expanding eligibility beyond previous law to include 14 program types listed in the bill.
HB 5331 clarifies that contracts between state agencies or local governments and vendors (such as cybersecurity insurers) cannot include terms that prevent compliance with mandatory security incident notification requirements. Specifically, it makes void and unenforceable any contract language prohibiting or restricting government entities from reporting security incidents as required by law. This bill directly affects state and local government agencies that enter into contracts for goods, services, or cybersecurity insurance. It does not change existing notification requirements but ensures contract terms cannot bypass these legal obligations. The law took effect immediately upon the governor's signature on June 20, 2025.
SB 2429 creates new protections for Texas residents' genetic data by prohibiting medical facilities, research organizations, and companies from sharing genetic information with foreign adversaries. The bill establishes a private right to sue for violations and imposes civil fines on entities that fail to prevent such access. It applies to any organization conducting genetic research or testing within Texas, including facilities receiving state funding. The law defines key terms like "foreign adversary" (per federal regulation) and "genome sequencing" to clarify coverage.
HB 130, the Texas Genomic Act of 2025, prohibits medical facilities, research organizations, companies, and nonprofits conducting genome sequencing in Texas from providing residents' genetic data to foreign adversaries. It creates a private right for individuals to sue entities that violate this rule and imposes civil penalties for noncompliance. The law applies to any entity handling human genome sequencing or testing within the state, defining "foreign adversary" per federal regulations. This policy directly affects organizations processing genetic data in Texas, requiring them to safeguard residents' information from unauthorized foreign access. The bill became effective September 1, 2025, after being signed by the governor.
HB 1061 authorizes Texas public school districts to be reimbursed for certification examination fees and related costs paid by teachers and students pursuing career and technology education certifications (including cybersecurity). The bill requires districts to pay these costs upfront and submit written applications to the commissioner for reimbursement, limiting students to one subsidy per exam. It modifies Texas Education Code sections to clarify eligibility for teachers who pass qualifying certification exams and establish reimbursement procedures. The law takes effect for the 2025-2026 school year, applying to all eligible certification exams under these provisions.
SB 1625 requires public water supply and wastewater systems in Texas to immediately report specific security incidents to the Texas Commission on Environmental Quality (TCEQ) and the Department of Information Resources. It mandates reporting for events like unauthorized access attempts, ransomware attacks, terrorism threats, or system disruptions that could impact water safety. Key examples include cyber intrusions targeting operational systems, theft of critical equipment, or natural disasters causing service outages. This directly affects all public water and wastewater providers across the state, including small nonindustrial systems. The bill clarifies reporting obligations without specifying enforcement actions or penalties.
HB 150 establishes the Texas Cyber Command as a new state agency under the Government Code, effective September 1, 2025. The bill transfers specific cybersecurity responsibilities from the Department of Information Resources to this new command, focusing on protecting critical infrastructure such as energy systems, water facilities, health care, and transportation networks. The command will handle cybersecurity incidents - including ransomware attacks and system breaches - by providing services to covered entities like local governments and private operators of critical infrastructure. This creates a dedicated state-level entity for coordinating cybersecurity efforts across vital systems, replacing the previous structure managed by the Department of Information Resources.
SB 78 requires the Texas Secretary of State to establish security rules for election data, including encryption standards and strict access controls limiting sensitive data to only necessary personnel. It mandates appointing a dedicated cybersecurity expert to implement protections, conduct biennial security assessments of election systems, and provide mandatory training for all staff handling election data. In case of a breach, the bill requires immediate notification to state leadership, restricted system access during investigations, and written alerts to affected individuals if personal data is compromised. The law directly affects state election offices, county election officials, and all personnel with access to election systems or data.
HB 876 requires the Texas Department of Information Resources to establish an intrastate information sharing organization where state agencies, local governments, public/private colleges, and private businesses can share cybersecurity threat details, best practices, and solutions. It also permits the department to create an interstate organization for Texas to share similar cybersecurity information with other states. The bill mandates the department provide administrative support for these organizations and clarifies that shared cybersecurity information is exempt from public disclosure requests under state and federal law. The measure takes effect September 1, 2025.
SB 2610 creates Chapter 542 in Texas law requiring businesses that handle sensitive personal information to implement reasonable cybersecurity programs. It makes businesses liable to individuals who suffer economic harm after a data breach caused by failure to follow these standards. Businesses meet the "reasonable" standard by adopting recognized frameworks like NIST, ISO 27000, or industry-specific standards (e.g., HIPAA for healthcare). The law applies specifically to breaches involving sensitive personal data and does not affect existing legal remedies available to the Attorney General.
