Processor (Texas Data Privacy and Security Act)
A person that processes personal data on behalf of a controller. Processors act on the controller's instructions and owe duties that flow from the controller-processor contract Chapter 541 requires. Role is a fact question under the statute, and a processor that starts determining purposes for itself is likely acting as a controller as to that processing, whatever the agreement says.
A processor handles personal data for someone else's purposes. Tex. Bus. & Com. Code § 541.001 defines it as a person that processes personal data on behalf of a controller, and everything a processor may do with that data traces back to the controller's instructions. Hosting providers, email senders, CRM systems and analytics tools are the usual examples.
The contract comes first
Section 541.104(b) requires a contract between controller and processor that governs the processor's data processing procedures. It must set out clear instructions for processing data, the nature and purpose of processing, the type of data subject to processing, the duration of processing, and the rights and obligations of both parties. It must also require the processor to ensure each person processing the data is subject to a duty of confidentiality, to delete or return all personal data at the controller's direction once the service is complete unless retention is required by law, to make available on reasonable request all information in its possession necessary to demonstrate compliance with the chapter, to allow and cooperate with reasonable assessments by the controller or the controller's designated assessor, and to engage any subcontractor under a written contract imposing the same requirements.
Section 541.104(c) gives the processor an alternative to sitting for the controller's assessment. It may arrange for a qualified and independent assessor to evaluate its policies and technical measures using an appropriate and accepted control standard or framework, and provide the resulting report to the controller on request.
Duties running alongside the contract
Under § 541.104(a) a processor must assist the controller in responding to consumer rights requests submitted under § 541.051, using appropriate technical and organizational measures as reasonably practicable and taking into account the nature of processing and the information available to the processor. It must also assist with the security of processing and with notification of a breach of the processor's system under Chapter 521.
That second duty grew on January 1, 2026. House Bill 149, the Texas Responsible Artificial Intelligence Governance Act, amended § 541.104(a)(2) to extend the security-assistance duty to personal data collected, stored and processed by an artificial intelligence system as that term is defined by Tex. Bus. & Com. Code § 551.001.
When a processor stops being one
Section 541.104(e) provides that whether a person is acting as a controller or a processor is a fact-based determination that depends on the context in which personal data is processed. A vendor that begins using client data to train its own model, build its own audience segments, or sell derived insights has started determining purposes. That vendor is likely acting as a controller as to that processing and may owe controller duties of its own, regardless of the order form, though the internal-research use preserved by § 541.202(a)(1) can bear on the analysis.
Section 541.104(d) is the companion caution. Nothing in the section relieves a controller or a processor of the liabilities each has under the chapter. Contractual allocation between the parties does not move statutory exposure. And because § 541.151 gives the attorney general exclusive enforcement authority and § 541.156 bars private suits, a controller has no claim under Chapter 541 against a misbehaving vendor. Its remedies lie in the contract and other law, alongside whatever the attorney general decides to do.