(a) A state agency shall permanently remove data from data processing equipment before disposing of or otherwise transferring the equipment to a person who is not a state agency or other agent of the state. This section applies only to equipment that will not be owned by the state after the disposal or other transfer.
(b) The department shall adopt rules to implement this section. The rules must include rules that:
(1) specify what types of data processing equipment are covered by this section, including computer hard drives and other memory components;
(2) explain the acceptable methods for removal of data; and
(3) adopt appropriate forms for use by state agencies in documenting the removal process, including forms for documenting completion of the process.