(1) The recipient and its subrecipients must adopt data retention and destruction policies that are in keeping with state and federal law including, but not limited to, chapter 19.215 RCW.

(2) Except as otherwise required by law or as provided in a data sharing agreement, protected personal information may be retained only until the permissible use has been fulfilled or 10 years. After the required permissible use or retention period has been met, the protected personal information must be destroyed.