Prohibits state agencies from storing payment credentials on state data systems.

Requires payment credentials, collected on behalf of a state agency to process payments for the agency, to be accepted and stored by a third-party institution.

Requires state agencies that currently store payment credentials to work with the office of the state chief information officer to eliminate that data from state data systems by July 1, 2020.