INSIGHTS

Most businesses tracking the Texas Data Privacy and Security Act (TDPSA) watch the Texas Attorney General’s office for signs of what is coming next. Right now, the office that matters most is the U.S. Small Business Administration.

On August 20, 2026, the SBA published a proposed rule that would raise the size standards used to determine which businesses count as “small” for federal purposes, alongside a companion methodology notice explaining how it got there. The comment period on both closes November 20, 2026. Because the TDPSA borrows the SBA’s small-business definition wholesale, whatever the SBA finalizes would automatically move thousands of Texas-connected companies across the line that determines whether Texas privacy law applies to them at all, with no vote required in Austin.

The TDPSA’s Small Business Exemption

Unlike most state privacy statutes, the TDPSA does not use a revenue threshold, consumer-count threshold, or data-sale percentage test to determine whether a business must comply with the statute. Instead, the TDPSA turns on whether you are a “small business.” Under Section 541.002 of the Texas Business and Commerce Code, the statute applies to any person that conducts business in Texas or produces a product or service consumed by Texas residents, and that processes or engages in the sale of personal data, unless that person is a small business as defined by the United States Small Business Administration.

The applicability of the TDPSA being fixed to the SBA’s definition of small business means that TDPSA coverage for a given company is not set by the Texas Legislature. It moves whenever the SBA moves its own size standards, which vary by industry and are tied to NAICS codes.

What the SBA Is Proposing

• The number of distinct size standards would shrink from 978, set at the 6-digit NAICS code level, to 338, mostly grouped at the broader 4- and 5-digit industry level.
• Many industries would shift from revenue-based thresholds to employee-count thresholds.
• The caps that historically limited how high thresholds could rise would be eliminated, and thresholds would adjust for both inflation and productivity growth.

The scale of the increases is substantial. Engineering services would move from a $25.5 million receipts threshold to $252 million. Architecture firms would move from $12.5 million to $135 million. Management consulting would move from $24.5 million to $295 million. The SBA estimates roughly 114,000 businesses nationwide would newly qualify as small under the proposal.

As of now, this is still just proposed rulemaking by the SBA, and it is still in the comments stage. Comments close November 20, 2026, and current size standards remain in effect until the SBA issues a final rule. The SBA could revise, narrow, or delay the final version in response to what it receives.

Why This Matters Beyond Federal Contracting

The SBA built this proposal to simplify its own rules and expand the small-business roster for federal procurement and lending programs. But because the TDPSA imports the SBA’s definition without pinning it to a particular year or edition, any final rule automatically resizes the population of businesses subject to Texas privacy law. 

If the proposal is adopted close to its current form, a meaningful number of professional services, engineering, consulting, and technology companies that are squarely covered by the TDPSA today, because they exceed the current SBA threshold for their industry, could fall below the new, higher threshold and drop out of most TDPSA obligations. That includes the requirement to honor consumer access, correction, deletion, and portability requests, to publish a privacy notice that complies with Section 541.102, and to recognize universal opt-out signals.

Companies on the other side of the line matter just as much. A business that has been treating itself as SBA-small, and therefore TDPSA-exempt, needs to confirm that status still holds once new thresholds take effect. Because the proposal raises thresholds without lowering any, the risk is less that the number moves against you than that the yardstick changes. Roughly 70 industries would convert from a receipts-based standard to an employee-based one, and a labor-intensive business with modest revenue can clear a receipts test comfortably while exceeding an employee cap.

What Texas Businesses Should Do Now

• Identify the NAICS code, or codes, that govern your SBA size determination. The TDPSA exemption turns on the SBA standard for your specific industry, not a general revenue figure. Size is also measured by a five-year average of receipts or a 24-month average of employees, and it aggregates the receipts and employees of all affiliates. A business that looks small on its own books may not be once commonly controlled entities are counted.
• Do not assume your current TDPSA compliance posture, whether that posture is “we comply” or “we are exempt,” will hold once a final rule takes effect. Build a checkpoint into your compliance calendar for when the SBA publishes final size standards.
• If your business sells sensitive personal data, remember that Section 541.107’s consent requirement applies regardless of whether you qualify as a small business. A change in SBA status does not eliminate that obligation.
• Watch both SBA dockets and consider filing a comment before November 20, 2026, if the proposed thresholds would change your TDPSA status. An SBA size-standard rulemaking rarely registers as a privacy issue.
• Treat this as a reminder to review your full multistate privacy posture. Do not read newfound “small business” status as a pass from privacy regulation generally. Other states use revenue or consumer-count thresholds that are independent of the SBA’s size standards, so a business that falls out of TDPSA coverage may still be squarely covered by California, Colorado, or another state’s privacy law.

We Can Help

Our attorneys advise businesses across Texas and nationally on data privacy compliance, including TDPSA applicability analysis, NAICS-based size standard determinations, and the interplay between federal small business rules and state privacy obligations. If you are uncertain where your business falls under the current or proposed standards or want a compliance program built to withstand a shifting threshold, we would welcome the opportunity to help.

This article is provided for general informational purposes and does not constitute legal advice. The rules discussed are proposed and not yet final. Businesses should consult counsel regarding their specific circumstances.

ABOUT THE AUTHOR