Creates the office of privacy and data protection, within the office of the state chief information officer, to serve as a central point of contact for state agencies on policy matters involving data privacy and data protection.

Requires the joint legislative audit and review committee to conduct a program and fiscal review of the office by June 30, 2025, and report its findings to the governor and the legislature by December 1, 2025. These requirements expire July 1, 2026.