EdLaw
Texas school cybersecurity — Education Code §11.175
Added by S.B. 820 (86th Legislature, 2019) and amended repeatedly since — most recently by H.B. 150 and H.B. 3512 (89th Legislature, 2025). Every Texas school district must adopt a cybersecurity policy, designate a cybersecurity coordinator, report cybersecurity incidents that constitute a breach of system security, and notify affected students' parents.
Applicability to EdTech
This section binds districts, not vendors — but it is the duty a vendor's incident-response and contract terms have to support, and the definitions decide when it fires:
- "Breach of system security" is defined by reference to student information that is sensitive, protected or confidential under state or federal law being "stolen or copied, transmitted, viewed, or used by a person unauthorized to engage in that action" (§11.175(a)(1)). Note the width: viewed by an unauthorised person is enough, with no harm threshold and no materiality qualifier.
- Reporting is "as soon as practicable after the discovery" of the attack or incident, to the agency or to the administrator of the anonymous incident-sharing system (§11.175(e)) — so a vendor that detects an incident on a district's behalf needs to notify the district fast enough for the district to meet that standard. There is no fixed hour count to design to, unlike the 48-hour rule in Puerto Rico's Ley 40-2024.
- Parent notification of any reportable incident involving a student's information is the coordinator's duty (§11.175(f)) — which requires the district to know which students' information was involved, and therefore requires the vendor to be able to say so.
- The district's cybersecurity coordinator is the named liaison with the Texas Education Agency (§11.175(d)); this is the person a vendor's security contact corresponds with.
- A district's policy may not conflict with the information-security standards adopted for institutions of higher education by the Texas Cyber Command under Government Code Chapters 2059 and 2063 (§11.175(c)) — the upstream standards that a district's requirements on suppliers tend to be derived from. Those Government Code chapters are not extracted in this corpus; add them if a district's security schedule cites them at us.
- The 2025 amendment adds annual artificial-intelligence training alongside cybersecurity training under Government Code §2063.103, mandatory for the coordinator and at district discretion for other staff (§11.175(h-1)).
Contents
| Document | Covers |
|---|---|
| SCHOOL-CYBERSECURITY.md | §11.175 in full |
Key obligations at a glance
- Adopt a cybersecurity policy to secure district cyberinfrastructure and to determine risk and implement mitigation planning — §11.175(b).
- Designate a cybersecurity coordinator as liaison with the agency — §11.175(d).
- Report any incident constituting a breach of system security as soon as practicable after discovery — §11.175(e).
- Notify parents of affected students — §11.175(f).
Enforcement
The section provides no penalty. Implementation runs through commissioner rules (§11.175(i)) and through the agency-operated anonymous incident-sharing system (§11.175(g)), which the agency may contract a qualified third party to administer ((h)). Those rules are not extracted in this corpus.
Licence
The reproduced text is Tex. Educ. Code §11.175, enacted by the Texas Legislature and served by the Texas Legislative Council on statutes.capitol.texas.gov. No copyright subsists in this text. In Georgia v. Public.Resource.Org, Inc., 590 U.S. 255 (2020), the Supreme Court held: "Under what has been dubbed the government edicts doctrine, officials empowered to speak with the force of law cannot be the authors of—and therefore cannot copyright—the works they create in the course of their official duties." It went on: "judges—and, we now confirm, legislators—may not be considered the 'authors' of the works they produce in the course of their official duties as judges and legislators. That rule applies regardless of whether a given material carries the force of law." (slip opinion, pp. 1 and 5–6, read 2026-10-01.)
The reproduced pages carry no copyright notice or terms of use (checked 2026-10-01 against the live pages or the builder's cached copies).
Public-domain text carries no conditions. The corpus attributes it all the same: the {.meta} provenance line on each section names the publisher, the Sources section links the official text, and the Meta section describes what the builder changed (markup and anchors only). Nothing here suggests that the Texas Legislature endorses the corpus.
Related
- Texas Education Code Subchapter D — the operator-side security duty (§32.155) this pairs with
- UK DfE digital and technology standards — the closest analogue: school-side cyber standards a vendor must fit
- CISA Cross-Sector Cybersecurity Performance Goals — the federal voluntary baseline
- NIST CSF — the framework districts' policies are usually written against
- Puerto Rico Ley 40-2024 — the corpus's other government-cybersecurity instrument, which binds contractors directly