District of Columbia Government Data Privacy and Protection Act of 2026

This bill establishes comprehensive privacy protections for personal data collected by District of Columbia government agencies and third parties on their behalf. It creates a new Chief Privacy Officer role within the Office of the Chief Technology Officer to oversee compliance and grants residents, employees, and service users specific rights over their information. Key provisions require agencies to obtain clear affirmative consent before selling data, strictly limit data collection to what is necessary for government services, and define sensitive categories such as health records and government identifiers that warrant extra care. The legislation also sets rules for how third parties must handle data received from the government and defines what constitutes personal versus de-identified information.