(a) Storage policy.--An entity that maintains, stores or manages computerized data on behalf of the Commonwealth that constitutes personal information shall develop a policy to govern reasonably proper storage of the personal information. A goal of the policy shall be to reduce the risk of future breaches of the security of the system.

(b) Considerations.--In developing the policy, an entity shall reasonably consider similar existing Federal policies and other policies, best practices identified by other states and relevant studies and other sources as appropriate in accordance with best practices as established by the Federal Government and the Commonwealth.

(c) Review and update.--The policy shall be reviewed at least annually and updated as necessary.