Texas SB 2610 took effect on September 1, 2025, and it applies to more than law firms: SB 2610 may help limit exemplary damages for eligible businesses that maintain a documented cybersecurity program; not legal advice or a guarantee. It focuses on Texas businesses with fewer than 250 employees in some data-breach lawsuits and does not provide immunity from actual damages, class actions, or regulatory enforcement. Nearly a year on, many Texas small businesses still miss the basics.
What Businesses Still Get Wrong
- No documentation. Having controls isn’t enough — the statute contemplates a documented, reviewed program.
- Email authentication left unenforced. SPF, DKIM, and DMARC are present but not enforcing.
- No annual review. The program is set up once and never revisited.
- No security awareness training. The most-required control across every framework.
Where to Start
Run a free scan at audit.emailmenow.com/?industry=texas-small-business to see your email and web security posture, then close the gaps and document the program. Work through our law firm cybersecurity audit checklist — the same controls apply to any Texas business under 250 employees.
The Golden Rule
Document everything and formally review your program annually — that’s the difference between “we had controls” and evidence you can point to in an SB 2610 program file.
See where you stand. Run the free audit and see automated products.
Sources: Spencer Fane (Shawn Tuma, Oct 29, 2025) on SB 2610 · Texas Bar Journal — What Texas SB 2610 means for businesses and law firms (Feb 2026)
SB 2610 may help limit exemplary damages for eligible businesses that maintain a documented cybersecurity program; not legal advice or a guarantee.