When a Texan Invokes Their TDPSA Rights: How to Answer a Data Request

The email you didn’t plan for

You’re used to customers asking about your schedule, your quote, your warranty. Then one day a different kind of message lands: “Under Texas law, please tell me what personal information you have about me, and delete it.” It’s polite, it’s specific, and it’s a right the Texas Data Privacy & Security Act now gives every Texan.

For a lot of shop owners, that email triggers a small panic — mostly because they’ve never thought about what they’d say. The good news: answering a TDPSA data request is a calm, four-step process, not a legal emergency. The businesses that struggle aren’t the ones who get the request. They’re the ones who can’t say what they hold or where it came from. If your records are clean, this is a lookup.

What the TDPSA lets your customers ask for

The TDPSA doesn’t just tell you to collect data carefully — it hands Texans rights they can exercise against you directly. In plain terms, a person can ask you to:

• Confirm and show the personal data you hold about them.
• Correct it if it’s wrong.
• Delete it.
• Opt out of the sale of their data and of targeted advertising built on it.

These aren’t theoretical. Any homeowner who priced a job on your site, any past customer, any lead can send one. And “we didn’t get around to it” is not a posture that ages well — Texas has made privacy a signature enforcement priority, and the pattern is clear from the first-ever enforcement suit under a comprehensive state privacy law to the $1.4 billion Meta settlement and the $1.375 billion Google settlement. The through-line in all of it is data collected or used without consent. A single request from one customer is a much smaller thing — but the way you handle it should reflect the same principle.

How to actually answer a request

Here’s the workflow, the way a five-truck shop should run it. This is general information rather than legal advice, so confirm the specifics for your business with a Texas attorney — but the shape is straightforward.

First, verify who’s asking. You don’t hand someone’s data to whoever emails asking for it. Confirm the request is genuinely from the person it concerns, using details you already have on file. Verification protects the customer and protects you.

Second, find their record. Search your CRM and wherever else their data lives for everything tied to that person — contact details, the job they inquired about, and critically, where the data came from and the consent behind it.

Third, respond within the deadline. The statute sets a window to reply; the point is that silence is the risky move. A timely, straight answer — even one that says “here’s what we hold” — is the whole ballgame.

Fourth, honor the request or explain the limit. Delete what they asked deleted, correct what’s wrong, stop the sale, or, where a lawful exemption applies, give a clear reason you can’t. What you don’t do is nothing.

The request that exposes bad records

There’s one version of this that turns a five-minute task into a genuine problem: a request lands and you can’t say where the data came from. If a lead was bought from a list or pulled off a shared platform, its origin is often a black box — someone else’s consent assumptions, or none at all. When a Texan invokes their rights and asks “where did you get my info,” “we bought it from a vendor” is not an answer you want on record.

That’s the quiet advantage of collecting on consent in the first place. With a consent-first approach, every lead arrives with a timestamped record of a homeowner who saw a clear banner and said yes — the origin and the permission are on file before any request comes in. So “what do you have and where did it come from” has a clean, one-lookup answer. The lead is exclusive to you at a flat $7, never resold, and delivered email-grade into the funnel you already run — Jobber, Housecall Pro, ServiceTitan, or HubSpot — with the receipt attached.

Build so the request is boring

• Keep the receipt on every lead. A timestamped consent log on a long audit trail means origin and permission are answerable instantly, not reconstructed under pressure.
• Know where data lives. If a customer’s information could be in three places, a deletion request is a scavenger hunt. Consolidate into the CRM you run.
• Have a person and a process. Decide now who handles a request and how, so it doesn’t sit in a shared inbox past the deadline.
• Collect on consent, not lists. The cleanest way to answer “where did you get this” is to have gotten a yes for it in the first place.

Consent Resolve was engineered to a stricter bar than any U.S. state law — the GDPR standard, whose maximum fine reaches €20 million or 4% of global revenue. Build to that and answering a TDPSA request becomes routine. Every figure here is sourced on our stats page.

A data request only feels scary when you don’t know what you’d say. Run a consent-first site, keep the receipts, and the answer is already sitting in your CRM. See why consent-first protects your shop, and weigh it against what your current lead channels really cost. This article is general information, not legal advice — for how the TDPSA applies to your specific business, talk to a Texas attorney.