Law / United States / 
Wyoming
Government data privacy: policy on the collection, access, retention, security and use of personal data, minimization and three-year retention limit
A sensitive categories rule binding government bodies.
- Obligation class
- Governance, Retention
- Audit expectation
- none
What it requires
- This section does not bind a state agency until , a county, city, town or public institution of higher education until , or any other political subdivision until (Senate Enrolled Act 32 of 2026, sections 4 and 5).
- If you are a government entity of Wyoming that collects or retains personal data, adopt, enforce and maintain a policy regarding the collection, access, retention, security and use of personal data consistent with all applicable federal and state laws (Wyo. Stat. Ann. sec. 9-21-203(a)).
- If you are a government entity of Wyoming, collect and maintain no more personal data than is reasonably necessary for your lawful functions, and only data necessary for a specific purpose identified in your adopted policies (Wyo. Stat. Ann. sec. 9-21-203(b)).
- If you are a government entity of Wyoming, do not maintain personal data for longer than three years unless a written policy identifies the extended retention period and gives a reasonable justification for it (Wyo. Stat. Ann. sec. 9-21-203(c)).
These lines are LexLint's reading of the law's text.
What record it asks for
Logging duty
Section 9-21-203 requires a government entity to adopt a policy on the collection, access, retention, security and use of personal data and sets a three-year retention rule. It requires no log or record to be kept, names no content fields, and sets no audit.
- Kind
- None
- As of
What this law does
Each government entity that collects or retains personal data must adopt, enforce and maintain a policy regarding the collection, access, retention, security and use of personal data consistent with all applicable federal and state laws, in addition to the data policy section 9-21-101 of the Wyoming Statutes requires where it applies.
No government entity may collect or maintain more personal data than is reasonably necessary for the performance of its lawful functions, and all personal data it collects and maintains must be necessary for a specific purpose identified in its adopted policies.
No government entity may maintain personal data for longer than three years without a written policy identifying the extended retention period and providing a reasonable justification for it, and the statutory retention requirements of sections 9-2-405 to 9-2-413 of the Wyoming Statutes are a reasonable justification.
A government entity to which the Health Insurance Portability and Accountability Act or the Family Education Rights and Privacy Act applies, and that complies with a written data collection and retention policy meeting that Act's requirements, is deemed compliant with the section. Section 2 of Senate Enrolled Act 32 of 2026, which created the section, is effective .
The section is effective as to counties, cities, public institutions of higher education and towns on , and as to each political subdivision other than state agencies, counties, cities, public institutions of higher education or towns on . The state chief information officer, in consultation with the state archivist, must develop sample policies for all government entities not later than .
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .