Concerning performance measures, duties, and reporting requirements for the office of privacy and data protection.

Washington strengthens oversight of personal data

Beginning June 11, 2026, the law sets duties and reporting rules for Washington’s Office of Privacy and Data Protection. The office is the central contact for state agencies on privacy policy, led by an appointed chief privacy officer. It must conduct annual privacy reviews and training, provide privacy guidance, and coordinate data protection. It must also help review major state agency projects involving personal information, including projects using artificial intelligence. For local governments, it must share best practices for collecting and storing personal information and provide training. It must teach consumers how personal information is used on mobile and digital networks and how to protect it. The law sets a performance report schedule of December 1, 2016, and every four years afterward, with measures established in 2016. Later reports must show results, including agency privacy improvements, available local government improvements, and coordination with national and international experts. Reports must also track public contacts and responses; training counts, topics, attendance, and participant feedback; government requests for technical help; staff education and certifications; and counts of initial privacy reviews and privacy impact assessments.