Minnesota. Breach notification. Act
MN breach lawMinnesota data breach notification law (Minn. Stat. § 325E.61 (private); § 13.055 (government))
Partly verified
Medium confidence. No verification notes recorded.§1Summary
- Synopsis
Requires businesses (and in most cases public bodies) that own or license computerised personal information about Minnesota residents to notify affected individuals after a security breach. Core timing rule: Individuals in the most expedient time possible. Covered data: name plus SSN, driver's licence/ID, financial account or card numbers with codes.
- Key themes
- Unique features
48-hour deadline to notify credit reporting agencies once more than 500 notices are sent; no AG notice for private sector.
- SaaS relevance
A SaaS provider hosting customer data is usually the 'maintaining' entity, not the owner: Minnesota requires the maintaining entity to notify the owner immediately after discovery. The owner customer then carries the individual and regulator notices, so contracts should fix timelines and cooperation.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- Individuals in the most expedient time possible; CRAs within 48 hours if >500 notified
- DPO
- No
- Cross-border transfers
- None
- Maximum penalty
- AG enforcement under § 8.31; private remedies available
§3Dates
- Key dates
- Adopted
- In force
- No private-sector amendment identified since 2005
§4Text and authority
- Text
- Authoritative text revisor.mn.gov
- Authority
- Minnesota Attorney General
§5Where it applies
- Domestic law of
- Minnesota
§6Sources and verification
- Sources consulted
- Verification
Medium confidence.
Partly verified
Medium confidence. No verification notes recorded.