Guidance and Resources for Wyoming Government Entities
History: Prior to the enactment of Senate File 20 (SF0020) during the 2026 Budget Session, there were previous iterations of the bill that did not gain traction: 2025 General Session — Senate File 65 (SF0065) and 2024 Budget Session — House Bill 163 (HB0163).
Wyoming enacted the Data Privacy in Government Entities Act (Enrolled Act No. 32) during the 2026 Budget Session of the 68th Legislature. The Act requires every Wyoming government entity to adopt written policies governing the collection, access, retention, security, and use of personal data. It establishes rights for Wyoming residents regarding personal data held by state and local government, and sets a staggered compliance schedule running through 2029.
The Wyoming Office of the Chief Information Officer (OCIO), in consultation with the State Archivist, is responsible under Section 3 of the Act for developing sample compliance policies for all government entities. This page hosts those resources. The guides below are the official sample policies developed to fulfill that requirement. Government entities may adopt them as written or adapt them to their specific circumstances.
Two tailored guides are available: one for local government entities and one for state agencies. Both were developed in consultation with the State Archivist and include sample policies that can be adopted as-is or adapted to meet your entity's needs.
A guide and ready-to-adopt policy template for compliance with the Data Privacy in Government Entities Act. Covers statutory definitions, data collection and retention, transfer restrictions, resident access and objection rights, data security, and enforcement. Six appendices include a vendor contract addendum, a resident request form, a system limitation form, a records retention policy template, and a clean adoption-ready version with all guidance removed.
A guide and enterprise policy template (WyIT-20xx) for compliance with the Data Privacy in Government Entities Act , effective July 1, 2027. It operates within Wyoming's existing WyIT policy suite and serves as both the governing enterprise baseline for agencies without their own policy and a template for agencies developing one. Covers public records scope, collection and retention, transfer restrictions, individual rights procedures, system modernization, and federal law preemption. Includes a clean adoption-ready version.
Legal references, guidance, and related materials supporting the Act.
Data Privacy in Government Entities Act
68th Legislature, 2026 Budget Session · Creates W.S. 9-21-201 and 9-21-202. Full text available at wyoleg.gov.
Wyoming Public Records Act
W.S. 16-4-201 through 16-4-205. The Data Privacy Act does not restrict or override public records disclosure obligations. Public records requirements remain fully in effect.
State record retention schedules:
W.S. 9-2-405 through 9-2-413.
Statutory retention schedules constitute a valid justification for retaining personal data beyond the Act's default three-year limit.
State agencies:
https://wyoarchives.wyo.gov/index.php/record-retention-schedules/361-schedules
Local governments (cities, counties, special districts):
https://wyoarchives.wyo.gov/index.php/record-retention-schedules/363-localgovernment
OCIO information security policies:
State IT security standards applicable to systems that collect or retain personal data. Available on the ETS website.
The Data Privacy in Government Entities Act establishes specific rights for all current and former Wyoming residents regarding personal data held by state and local government entities. A legally authorized representative may act on a resident's behalf. These rights apply to the entity that holds the data — contact that entity directly to exercise any of the rights below.
Any current or former Wyoming resident may request a copy of personal data that a government entity maintains about them. The entity may charge a fee for producing the data, consistent with fees permitted under the Wyoming Public Records Act (W.S. 16-4-201 through 16-4-205).
If you believe your personal data held by a government entity is inaccurate, incomplete, not pertinent, outdated, irrelevant, retained too long, improperly shared, or that you have been wrongly denied access to it, you may file a written objection directly with that entity.
The entity must, within 60 days of receiving your objection:
Verify your identity
Review whether the objection has merit
If it does: correct, restrict, delete, or grant access to the data as appropriate
If it does not: allow you to have a personal statement maintained in the record alongside the disputed data
Notify you in writing of its decision
If a government entity reviews your objection and finds it does not have merit, you still have the right to submit a statement reflecting your position. That statement must be kept with your personal data in the entity's records.
No government entity may purchase, sell, trade, or transfer your personal data without your express written consent. Limited exceptions apply by law, including:
Transfers to another government entity that is also subject to and compliant with this Act
Transfers to a contractor providing services on behalf of the government entity, under a contract that requires data protection and mandates return or destruction of data when the service ends
Transfers required or permitted under HIPAA or FERPA
Exceptions approved in writing by the entity's elected governing authority, on a case-by-case basis, for a period not to exceed two years
Enrolled Act No. 32, Senate · 68th Legislature of the State of Wyoming · 2026 Budget Session
Creates W.S. 9-21-201 and 9-21-202; W.S. 9-21-203
Wyoming State Statutes § 9-2-405 through § 9-2-413
Title 9 — Administration of the Government · Chapter 2 · Article 4 — State Archives, Museums and Historical Department
Questions about the Act or these resources
Email: privacy@wyo.gov
Cities, counties, and special districts
Each entity is responsible for its own personal data. Contact your city, county, or special district directly for data access requests, objections, or questions about their practices.
State agencies
Contact the relevant agency directly for data requests. For compliance questions: privacy@wyo.gov
