Personal data collection and retention by government entities. Note: this section is effective as of 7/1/2027.
Wyo. Stat. Ann. § 9-21-203
in effect(a) In addition to the policies required under W.S. 9-21-101, if applicable, each government entity that collects or retains personal data shall adopt, enforce and maintain a policy regarding the collection, access, retention, security and use of personal data consistent with all applicable federal and state laws, including this article.
(b) No government entity shall collect or maintain more personal data than is reasonably necessary for the performance of the government entity's lawful functions. All personal data collected and maintained by government entities shall be necessary for a specific purpose identified in the adopted policies of the government entity.
(c) No government entity shall maintain personal data for longer than three (3) years without a written policy identifying the extended retention period and providing a reasonable justification for the extended retention period. Statutory retention requirements provided for in W.S. 9-2-405 through 9-2-413 constitute a reasonable justification.
(d) A government entity to which the Health Insurance Portability and Accountability Act or the Family Education Rights and Privacy Act applies that is compliant with a written data collection and retention policy that meets the requirements of the Health Insurance Portability and Accountability Act or the Family Education Rights and Privacy Act shall be deemed compliant with this section.
Source: WY Statutes (Official Site)URL: https://wyoleg.gov/statutes/compress/title09.pdfFetched: 10/4/2026