Privacy Map

Minnesota. Comprehensive data protection. Act

MCDPAMinnesota Consumer Data Privacy Act (Minn. Stat. ch. 325M)

In force
Partly verifiedMedium confidence. dpo_required Conditional: controllers must document policies and name a chief privacy officer or equivalent (per established knowledge). Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.

§1Summary

Synopsis

Comprehensive law adding a right to question the result of profiling decisions and to obtain a list of specific third parties, plus mandatory data inventories.

Key themes
  • consumer rights (access, deletion, correction, portability)
  • opt-out of sale, targeted advertising and profiling
  • sensitive data consent
  • data protection assessments
  • processor contracts
  • right to question profiling
  • data inventory
  • specific third-party list
Unique features

Right to be told reasons for a profiling decision and to have it reviewed; documented data inventory and privacy policies required.

SaaS relevance

Applies at 100,000 Minnesota consumers, or 25,000 with 25%+ revenue from sales; small businesses (SBA) exempt except for sensitive data sale.

§2Obligations

Extraterritorial
Yes
Breach notification
See Minn. Stat. § 325E.61 (separate statute)
DPO
Conditional
Cross-border transfers
None
Maximum penalty
$7,500 per violation

§3Dates

Key dates
  • Adopted
  • In force
  • Postsecondary institutions from 2029-07-31; cure period ended 2026-01-31.

§4Text and authority

Text
Authority
Minnesota Attorney General

§5Where it applies

Domestic law of
Minnesota

§6Sources and verification

Sources consulted
Verification

Medium confidence.

Partly verifiedMedium confidence. dpo_required Conditional: controllers must document policies and name a chief privacy officer or equivalent (per established knowledge). Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.