The United States has no single federal data-privacy statute; instead, dozens of states have enacted their own laws taking effect on a rolling basis. The Texas Data Privacy and Security Act (TDPSA), effective 1 July 2024, is among the broadest — notably, it sets no revenue threshold. Vietnamese businesses selling goods, providing digital services or processing data of Texas users may well fall within its scope.
Who the TDPSA applies to
The Act applies to controllers and processors conducting business in Texas or providing products or services targeted at Texas residents, where in the prior year they processed personal data of at least 100,000 consumers, or 25,000 if they sell personal data. Unlike many states, the TDPSA imposes no revenue threshold — a small business with a large user base is still covered. Employment-context data and data already governed by federal law (e.g., HIPAA, GLBA) are excluded.
Consumer rights and business duties
- Data-subject rights: to know/confirm, access, correct, delete and port personal data; to opt out of targeted advertising, sales of personal data and profiling in furtherance of decisions with legal effects.
- Controller duties: data minimisation, reasonable security, non-discrimination against users exercising rights, data protection assessments (DPIA) for high-risk processing, and binding processors by contract.
- Consent: opt-in required for sensitive data (health, biometrics, religion, politics, precise geolocation, etc.).
- Who enforces: only the Texas Attorney General may bring actions — no private right of action; penalties apply under the Texas Deceptive Trade Practices Act.
Comparison with Vietnam’s framework
Vietnam applies the Personal Data Protection Law 91/2025/QH15 (effective 1 January 2026) and Decree 356/2025/ND-CP (effective 1 January 2026, replacing Decree 13/2023/ND-CP): built on consent of the data subject, impact assessments for outbound transfers, enforced by the Ministry of Public Security. The TDPSA, conversely, is built on opt-out (except sensitive data) with no state registration requirement. Vietnamese businesses serving both markets must design privacy policies satisfying both logics at once: consent-first for Vietnamese users, full opt-out for Texas users.
What Vietnamese businesses should do
- Measure: do you process data of more than 100,000 Texas residents per year (or 25,000 with data sales)? If so, the TDPSA applies.
- Add opt-out mechanisms for targeted advertising, data sales and profiling on websites/apps (e.g., a “Your Privacy Choices” link).
- Review the Act’s very broad definition of “sale” — sharing data with advertising partners may count as a sale.
- Prepare a workflow to receive and respond to rights requests within 45 days.
- Separate compliance streams: a single US-wide privacy policy is not enough; add state-specific addenda for states with their own laws (Texas, California, etc.).
Frequently asked questions
Our company is based only in Vietnam but sells online to Texas customers — does the TDPSA apply?
Possibly. The TDPSA requires no physical presence in Texas; it suffices that the business “conducts business in Texas or provides products or services targeted at Texas residents” and exceeds the consumer-count thresholds. Online sales deliberately targeting the Texas market usually meet this test.
Does the TDPSA let consumers sue businesses?
No. The TDPSA creates no private right of action; enforcement rests with the Texas Attorney General. This differs from some other states and from Vietnam’s administrative complaint mechanism.
Does “sale” of data under the TDPSA include sharing with advertising partners?
It can. “Sale” is defined very broadly: exchanging personal data for monetary or other valuable consideration. Sharing data with ad networks or measurement platforms in return for services is typically treated as a sale — which lowers the applicability threshold to 25,000 consumers.
Does GDPR compliance automatically mean TDPSA compliance?
Not automatically, though a GDPR foundation helps greatly. The TDPSA differs on applicability thresholds, opt-out scope, the definition of sensitive data and its own enforcement regime. A supplementary review is needed rather than assuming GDPR compliance suffices.
Contact FLAT Law Firm
FLAT Law Firm helps Vietnamese businesses assess the applicability of US state privacy laws, draft multi-market privacy policies and design parallel Vietnam–US compliance workflows. Contact us for a tailored assessment.
This article has been quality-reviewed by the FLAW AI Legal Council
