This bill establishes new regulations for government entities in Wyoming regarding the collection, access, security, and use of personal data. It introduces definitions for key terms such as "deidentified data," "government entity," "personal data," and "personal digital identity." The bill mandates that government entities must adopt policies that ensure personal data is collected and maintained only as necessary for their lawful functions, and it prohibits the sale or transfer of personal data without the express written consent of the individual, with certain exceptions. Additionally, it allows residents to request copies of their personal data and to file objections regarding its accuracy or handling.

The legislation also sets specific timelines for the implementation of these policies, requiring state agencies to adopt necessary procedures by July 1, 2026, and other political subdivisions by July 1, 2028. Furthermore, it stipulates that personal data cannot be retained for more than three years without a written policy justifying the extended retention. The bill emphasizes compliance with existing federal and state laws, and it includes provisions for the development of sample policies by the state chief information officer by January 1, 2026. The effective dates for various sections of the bill are outlined, with some provisions taking effect immediately upon passage.