Requires each department or other agency of the state government to designate an agency privacy officer.

Requires an agency privacy officer, in coordination with the office of privacy and data protection, to: (1) Develop an agency personal information minimization policy to reduce the use and retention of personal information wherever possible; and

(2) Create a work plan that uses a Gantt chart or similar project planning tool for certain information.

Prohibits a governmental entity from selling: (1) Personal financial and health information; and

(2) Personal identification numbers issued by a government entity.

Exempts the following from disclosure under the public records act: Personal information inventory or data map records, created in this act, that reveal the location of personal information or the extent to which it is protected.