Minnesota Consumer Data Privacy Act (MNCDPA) Assessment

MNCDPA applies only where there is a Minnesota business or targeting nexus.

MNCDPA generally applies if, in a calendar year, your organization controls or processes personal data of at least 100,000 consumers, excluding data processed solely to complete payment transactions, or derives more than 25% of gross revenue from the sale of personal data and controls or processes personal data of at least 25,000 consumers.

MNCDPA includes exemptions for certain government entities, federally recognized Indian tribes, certain financial institutions, certain insurers principally engaged in financial activities, small businesses, certain nonprofit anti-fraud entities, and certain air carriers. It also excludes multiple categories of data, including various HIPAA-related data, FCRA data, GLBA data, DPPA data, FERPA data, FCA data, employment-related data, Minnesota insurance-reporting-act data, and some payment-only transaction data.

A current data map should show what personal data is collected, where it is stored, how it is used, how it flows internally and externally, who can access it, and what safeguards apply.

Under MNCDPA, sensitive data includes racial or ethnic origin, religious beliefs, mental or physical health condition or diagnosis, sexual orientation, citizenship or immigration status, biometric or genetic data used to uniquely identify an individual, personal data of a known child, and specific geolocation data.

Minnesota’s law is structured around controller duties and permitted processing rather than a single closed list of legal bases. Your organization should still document why each processing activity is allowed and where consent is required, especially for sensitive data and certain teen-related processing.

Minnesota requires opt-in consent before processing sensitive data. It also requires parental consent for children under 13 and consent before sale or targeted advertising involving consumers aged 13 to 16 when the controller knows their age.

Minnesota gives consumers the right to opt out of targeted advertising, sale of personal data, and profiling in furtherance of decisions that produce legal or similarly significant effects. The law also recognizes approved opt-out preference signals and universal mechanisms.

Minnesota requires a privacy notice that includes categories of personal data collected, purposes, how rights can be exercised including appeals and revocation where applicable, third parties with whom data is shared, categories of personal data shared, contact methods, retention policies, and the notice’s last updated date. The notice must also be displayed conspicuously and be accessible, including to people with disabilities and in the relevant languages where applicable.

Minnesota gives consumers rights to confirm and access, correct inaccuracies, delete personal data, data portability, obtain a list of specific third parties to whom data was disclosed, opt out of certain processing, and question or review certain profiling decisions. Parents, legal guardians, conservators, and authorized agents may also act in some circumstances.

Minnesota generally requires action on requests within 45 days, with one possible 45-day extension when reasonably necessary. Appeal decisions generally must be given within 45 days, with a possible 60-day extension in some cases. Consumers generally receive two free requests per year, after which reasonable fees may apply in limited circumstances. Organizations must also maintain appeal records for 24 months.

Minnesota prohibits discrimination against consumers for exercising their rights and also contains broader guardrails against certain discriminatory processing outcomes in areas like housing, employment, credit, education, and public accommodations.

Minnesota requires reasonable administrative, technical, and physical safeguards to protect confidentiality, integrity, and accessibility, and emphasizes that controls should be appropriate to the nature and volume of the personal data at issue.

Minnesota requires organizations to maintain written documentation describing privacy policies and practices, and to conduct Data Privacy and Protection Assessments for high-risk activities such as targeted advertising, selling personal data, sensitive-data processing, and certain profiling. The Attorney General may request these assessments during an investigation.

Minnesota requires controller-processor contracts with specific terms around instructions, purpose, duration, rights and duties, confidentiality, deletion or return, assessment rights, and processor assistance. Minnesota’s separate breach-notification law also requires notice to affected individuals in the most expedient time possible and without unreasonable delay, and notice to nationwide consumer reporting agencies within 48 hours if more than 500 Minnesota residents are notified at one time.