Prohibits state agencies from storing payment credentials on state data systems, except under certain circumstances.

Prohibits third parties from transferring, selling, monetizing, or otherwise sharing any payment credential data stored for agencies.

Requires the office of the chief information officer to develop a policy, to be followed by all agencies, to minimize agency retention of personally identifiable information.