Does Your Accounting Firm Already Qualify for Texas's New Breach Safe Harbor?

If your Texas firm has fewer than 250 employees and already keeps the written security plan the FTC requires of tax and accounting practices, you are most of the way to the breach safe harbor Texas created in 2025. Senate Bill 2610, effective September 1, 2025, bars a plaintiff from recovering exemplary (punitive) damages in a lawsuit arising from a data breach, as long as the business had a qualifying cybersecurity program in place at the time. The law scales what "qualifying" means to your head count, and it names the Gramm-Leach-Bliley standard that accounting firms already follow as one way to meet it.

So the practical question for a firm in Houston, Dallas or anywhere else in the state is not "do we need to start a cybersecurity program." If you prepare returns or keep client books, federal law already says you do. The question is whether the plan you are supposed to have is documented, current, and sized to the tier SB 2610 puts you in, so that it would actually count as evidence after an incident.

This article maps the new Texas protection onto the obligation accounting and professional-services firms already carry, shows which tier your head count falls into, and gives a four-step way to turn an existing plan into safe-harbor evidence. It is written for a managing partner or firm administrator, not a security engineer.

See how AI consulting and implementation works for accounting and professional-services firms.

What the safe harbor gives you, and what it doesn't

SB 2610 adds Chapter 542 to the Texas Business & Commerce Code. Its reach is narrow and specific: a person harmed by a breach of system security "may not recover exemplary damages" from a covered business that demonstrates it implemented and maintained a compliant program when the breach occurred. That is the whole benefit. It is a shield against punitive damages, not immunity.

Three limits matter for how you weigh it. First, actual (compensatory) damages are untouched, and the statute expressly creates no new cause of action and changes no existing legal duty, so a client can still sue and still recover provable losses. Second, it does nothing about regulator action; the Texas Attorney General's enforcement powers and your federal obligations continue regardless. Third, the protection is prospective and conditional: it applies only to claims that accrue on or after September 1, 2025, and only if you can show the program was genuinely in force at the time, not reconstructed afterward. The value, then, is real but bounded. It rewards a firm that can prove it was doing the work.

Which tier your head count puts you in

The law applies only to Texas business entities with fewer than 250 employees that own or license computerized data containing sensitive personal information. Almost every independent accounting firm meets both parts: you are under the ceiling, and you hold Social Security numbers, bank details and financial records. Within that range, SB 2610 sets three tiers, and the program it expects grows with the firm.

The named frameworks include the NIST Cybersecurity Framework, NIST Special Publications 800-171 and 800-53, the CIS Critical Security Controls, the ISO/IEC 27000 series, SOC 2, and the Secure Controls Framework. Crucially for accounting firms, the list also counts Title V of the Gramm-Leach-Bliley Act for any entity already subject to it, and the Health Insurance Portability and Accountability Act where it applies. If a standard you rely on is updated, you keep the safe harbor by updating your program by the later of the new standard's implementation date or the first anniversary of its publication.

You probably already have the core: your WISP

Here is the overlap most coverage of SB 2610 misses. Under the FTC Safeguards Rule, which implements Gramm-Leach-Bliley, tax preparation firms are "financial institutions" and must maintain a written information security program. The IRS says the same thing to practitioners every year: as it reminded tax pros in August 2026, "Federal law requires tax and accounting professionals to create and maintain a Written Information Security Plan," and Publication 5708 provides a template for smaller practices.

That plan, the WISP, is not a different animal from what SB 2610 wants. The Safeguards Rule requires the pieces Texas is asking you to document: a qualified individual who owns the program, a written risk assessment, access controls, encryption of client data at rest and in transit, multi-factor authentication, oversight of service providers, an incident-response plan, and staff training. Because Gramm-Leach-Bliley is on the SB 2610 framework list, a firm that genuinely maintains its required WISP can point to that same standard as its path to the Texas safe harbor. The work is mostly done; the gap is usually in proving it.

Turn your WISP into safe-harbor evidence: four steps

This is an editorial decision method, not legal advice, and following it does not guarantee a court will find a program sufficient. It is a way to line up what you already owe against what Texas now rewards, so a reasonable firm can see its gaps.

1. Confirm scope. Count full-time-equivalent employees to fix your tier, and confirm in one line that you hold sensitive personal information. For virtually all firms the answer is yes, which means both the Safeguards Rule and SB 2610 apply.
2. Name your framework. If you keep a WISP, Gramm-Leach-Bliley is your anchor framework because it is on the Texas list. For the 20-to-99 tier, lay the CIS Implementation Group 1 safeguards next to your WISP controls and note where they already match.
3. Close the common gaps. The elements firms most often skip are multi-factor authentication on every system that touches client data, encryption of stored files and backups, written oversight of outside vendors, and an incident-response plan that names who does what. Fix those, then date and version the plan.
4. Keep dated proof. The statute conditions the shield on a program "implemented and maintained" at the time of a breach. Retain training logs, the signed annual review, vendor contracts and risk-assessment dates, so the program is demonstrable rather than asserted.

The new data paths your automation creates

Most firms adopting AI are doing it exactly where client data lives: document intake and optical character recognition that reads 1099s and bank statements, client portals, cloud tax and bookkeeping software, e-signature, and outsourced or offshore preparation. Each of those is a service provider under the Safeguards Rule and a new place sensitive data flows, and both your WISP and your SB 2610 program have to cover it. A tool that extracts figures from a scanned brokerage statement is handling the same data a locked filing cabinet used to.

Consider an illustrative example; the following firm is hypothetical and used only to show the steps. A 35-person Houston tax and advisory practice adds an AI document-intake tool to speed up busy season. Because it has 35 employees, it sits in the 20-to-99 tier, so CIS Implementation Group 1 is its reference point. Adopting the tool does not change the tier, but it does change the plan: the vendor joins the service-provider list with a security clause in its contract, the firm confirms multi-factor authentication and encryption on the portal the tool uses, it updates the written risk assessment to include the new data path, and it re-dates the WISP. The judgments stay with people: deciding what client data the tool may touch, approving the vendor, and signing the annual review. When you are weighing such a vendor, an evidence-based supplier-comparison planning aid can keep the security questions in the selection, not after it.

The payoff is that the same documentation serves three masters at once: it satisfies the federal WISP mandate, it supports the Texas safe harbor, and it gives you a clear-eyed view of where automation has widened your exposure. One plan, kept current, does all three.