This bill establishes new regulations for government entities in Wyoming regarding the collection, access, security, and use of personal data. It introduces definitions for key terms such as "deidentified data," "government entity," "personal data," and "personal digital identity." The bill mandates that government entities must adopt policies that comply with these definitions and outlines specific limitations on the handling of personal data. Notably, it prohibits government entities from purchasing, selling, trading, or transferring personal data without the express written consent of the individual, with certain exceptions for transfers between government entities and compliance with existing federal laws.

Additionally, the bill requires that each government entity that collects or retains personal data must maintain a policy that aligns with federal and state laws, ensuring that only necessary data is collected and retained for a defined purpose. It sets a maximum retention period of three years for personal data unless a justified extension is documented. The bill also provides residents with the right to request their personal data and to object to its accuracy or handling, with specific procedures for addressing such objections. The implementation of these policies is staggered, with deadlines for state agencies, counties, cities, and other political subdivisions to comply by 2026 and 2028.