Affiliation Rules (Texas Privacy and SBA Size)

Affiliates come up twice in a Texas privacy analysis, and the two rules pull against each other. Inside Chapter 541, affiliate status is a shield: transfers to an affiliate are not sales, and affiliates are not third parties. Outside it, in the SBA size standards that determine whether most of Chapter 541 applies, affiliation is a trap, because affiliates get counted together.

Affiliates under Chapter 541

Section 541.001 defines an affiliate as a legal entity that controls, is controlled by, or is under common control with another legal entity, or that shares common branding with another legal entity. Control means ownership of, or the power to vote, more than 50 percent of the outstanding shares of any class of voting security, control in any manner over the election of a majority of the directors or individuals exercising similar functions, or the power to exercise a controlling influence over management.

Two consequences follow. The definition of sale of personal data excludes the disclosure or transfer of personal data to an affiliate of the controller, so intercompany data movement inside a corporate group does not by itself trigger the sale opt-out or the sensitive-data sale notice in § 541.102(b). And the definition of third party excludes an affiliate of the controller or processor, which narrows the third-party line items a privacy notice must carry under § 541.102(a).

Neither exclusion reaches further than the transfer itself. Once the affiliate holds the data it may be a controller of that data in its own right, and if Chapter 541 reaches it, it owes its own duties, including the sensitive data consent rule in § 541.101(b)(4) and its own notice under § 541.102. Common branding also deserves a flag: two entities with no ownership overlap at all can still be affiliates under Chapter 541 if they share branding, which matters for franchise systems and professional service alliances built on a shared name.

Affiliation under SBA rules

The definition that decides coverage is not in the Texas statute. Because § 541.002(a)(3) borrows the SBA's small business definition, the SBA's affiliation regulation at 13 C.F.R. § 121.103 very likely comes with it, since SBA size determinations count affiliates. Concerns and entities are affiliates of each other when one controls or has the power to control the other, or a third party or parties controls or has the power to control both, and it does not matter whether control is actually exercised so long as the power exists. Under 13 C.F.R. § 121.103(a)(6) the SBA counts the receipts, employees or other measure of size of the concern whose size is at issue and all of its domestic and foreign affiliates, regardless of whether the affiliates are organized for profit.

Aggregation is what catches people. A newly formed Texas subsidiary with two employees and no revenue is not a small business if its parent is large. Portfolio companies under common fund control can aggregate, subject to exceptions such as the one in 13 C.F.R. § 121.103(b)(1) for concerns owned by licensed small business investment companies. So do sibling entities in a family holding structure, and the SBA looks past formal ownership to options, convertible instruments, agreements to merge and identity of interest among close relatives. The Texas privacy definition of control and the SBA concept of control are not the same test, and a group can fail the SBA test while its members would not qualify as affiliates under § 541.001.

Run them in the right order

The group analysis logically comes first. It maps the entities under common control, aggregates size using the correct industry code, and identifies which entities in the group are covered by Chapter 541. The Chapter 541 affiliate definitions then sort the data flows inside the group into sales and internal transfers.