Minnesota Consumer Data Privacy Act (MCDPA)

The MCDPA was signed into law on May 24, 2024, and will become effective on July 31, 2025.

The MCDPA provides consumers with rights such as the right to confirm and access, correct inaccuracies, delete and obtain personal data, opt-out, question the result of profiling, and the right to obtain the list of third parties.

The MCDPA applies to businesses operating in Minnesota or targeting Minnesota residents if they control or process personal data of at least 100,000 consumers annually, or derive over 25% of gross revenue from selling personal data of at least 25,000 consumers.

The MCDPA imposes several business obligations, such as obtaining consent, ensuring data minimization and purpose limitation, conducting data protection assessments for high-risk processing activities, maintaining a data inventory, disclosing a privacy notice, and establishing robust security safeguards.

The Minnesota Attorney General enforces the MCDPA. Noncompliance can lead to penalties of up to $7,500 per violation.