(a) On written request sent by certified mail that includes proper identification provided by a consumer, a consumer reporting agency shall place a security freeze on a consumer’s consumer file not later than the fifth business day after the date the agency receives the request.
(b) On written request for a security freeze provided by a consumer under Subsection (a), a consumer reporting agency shall disclose to the consumer the process of placing, removing, and temporarily lifting a security freeze and the process for allowing access to information from the consumer’s consumer file for a specific requester or period while the security freeze is in effect.

(c) A consumer reporting agency shall, not later than the 10th business day after the date the agency receives the request for a security freeze:
(1) send a written confirmation of the security freeze to the consumer; and
(2) provide the consumer with a unique personal identification number or password to be used by the consumer to authorize a removal or temporary lifting of the security freeze under § 20.037.
(d) A consumer may request in writing a replacement personal identification number or password. The request must comply with the requirements for requesting a security freeze under Subsection (a). The consumer reporting agency shall not later than the third business day after the date the agency receives the request for a replacement personal identification number or password provide the consumer with a new unique personal identification number or password to be used by the consumer instead of the number or password that was provided under Subsection (c).