Prohibits state agencies from storing payment credentials on state data systems.

Requires payment credentials, collected on behalf of a state agency to process payments for the agency, to be accepted and stored by a third-party institution.

Prohibits the third-party institution from transferring, selling, trading, monetizing, or otherwise sharing that data.

Requires state agencies that currently store payment credentials to work with the office of the state chief information officer to eliminate that data from state data systems by July 1, 2020.