Establishes the data management and protection act.

Prohibits a state agency from selling personal data to third parties except as authorized by law.

Requires state agencies that are authorized by law to sell information containing the personal data of individuals to third parties, to take affirmative steps to protect the data from impermissible subsequent use, transfer, or sale by the third parties.

Requires the office of privacy and data protection to: (1) Publish a statement of principles to promote responsible stewardship of the state's structured data assets regarding data minimization, due diligence, sensitive data and sensitive contexts, data quality, open data, transparency and accountability, and data security; and

(2) Provide a design template for consumer access to data and develop compliance criteria to meet the requirements of chapter 43.105 RCW (consolidated technology services agency).