NAICS Code (TDPSA Applicability)
The federal industry classification code that determines whether a business is small under Small Business Administration size standards, and therefore whether most of the TDPSA applies to it. Section 541.002(a)(3) exempts a small business as the SBA defines one. SBA size standards are published by NAICS code, some in average annual receipts and some in employee counts.
Most privacy statutes tell you whether they apply by counting customers or revenue. Texas sends you to a federal size standards table. Under Tex. Bus. & Com. Code § 541.002(a)(3), Chapter 541 applies only to a person that conducts business in Texas or produces a product or service consumed by Texas residents, processes or sells personal data, and is not a small business as defined by the United States Small Business Administration. The chapter sets no separate revenue or consumer-count threshold, and § 541.002(b) exempts certain entities, including nonprofit organizations and institutions of higher education.
How a code decides coverage
The SBA does not use a single definition of small. It publishes size standards by industry, keyed to North American Industry Classification System codes, at 13 C.F.R. § 121.201, and the standards are expressed either in number of employees or in average annual receipts depending on the industry. Manufacturing and wholesale codes generally use employee counts. Service, retail and construction codes generally use receipts. Receipts are calculated under 13 C.F.R. § 121.104 and employees are counted under 13 C.F.R. § 121.106, each on an averaging convention rather than a single-year snapshot. The underlying statutory definition of a small business concern sits at 15 U.S.C. § 632.
Two Texas companies with identical financial statements can therefore get opposite answers. A software publisher and a general contractor sit under different codes carrying different standards. The classification is not a formality, and picking a code because it looked right on a government form six years ago is how a business ends up wrong about whether a privacy statute governs it.
Choosing the code, then checking affiliation
SBA rules identify a concern's primary industry by considering the distribution of its receipts, employees and costs of doing business across industries for the most recently completed fiscal year (13 C.F.R. § 121.107). Companies with genuinely mixed operations sometimes have a defensible argument for more than one code. If the attorney general investigates, it may issue a civil investigative demand under Tex. Bus. & Com. Code § 541.153.
Then check affiliation, because it is where the analysis usually breaks. SBA rules at 13 C.F.R. § 121.103 treat concerns as affiliates when one controls or has the power to control the other, or a third party controls or has the power to control both, and the power to control is enough whether or not it is exercised. Under 13 C.F.R. § 121.103(a)(6) the SBA counts the receipts, employees or other measure of size of the concern whose size is at issue together with all of its domestic and foreign affiliates. A small Texas operating entity owned by a large parent is not a small business.
The carve-out is partial and it is dated
A business that clears the small business test still cannot sell sensitive personal data without prior consumer consent. Section 541.002(a)(3) preserves § 541.107 by its own terms, and § 541.107(b) makes a violator liable for the penalty under § 541.155. So the exemption is from the chapter's machinery, not from every duty in it.
The conclusion can change. The SBA revises size standards by industry on a rolling schedule and adjusts receipts-based standards for inflation, and a growing company can cross the line without any event that would ordinarily trigger a legal review. Chapter 541 does not say who bears the burden of showing that a person is a small business.