Law / United States / 
Minnesota
Minnesota breach notification
In force since .
A breach notification rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Data subject residence
- Audit expectation
- none
What it requires
- Disclose a breach of the security of the system to an affected Minnesota resident in the most expedient time possible and without unreasonable delay. Minnesota sets no fixed numeric-day cap on notice to residents, unlike several peer states.
- If you discover circumstances requiring notification of more than 500 persons at one time, also notify, within 48 hours, every nationwide consumer reporting agency of the timing, distribution, and content of the notices (Minn. Stat. 325E.61, subd. 2).
- Notify the data owner immediately upon discovering a breach if you maintain, but do not own, the affected data.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Is a ransomware attack that encrypts or locks personal information, with no copy leaving the system, an 'unauthorized acquisition of computerized data' that is a 'breach of the security of the system' under Minn. Stat. 325E.61, subdivision 1(d)?
What it makes you log
Logging duty
Section 325E.61 requires notice of a breach to affected Minnesota residents, notice to the data owner by a person that maintains data it does not own, and notice within 48 hours to the nationwide consumer reporting agencies when more than 500 persons are notified. It requires no record of a breach, of a decision not to notify or of the notice sent, so a duty to notify alone is not a log. A person that conducts business in the state is the operator test and notice owed to a state resident is the residence test.
- Kind
- None
- As of
What this law does
Minnesota's breach notification duty, a separate and pre-existing chapter from MCDPA, was originally enacted by 2005 Minn. Laws ch. 167, section 1, and has since been amended by 2006 Minn. Laws ch. 212, article 1, sections 17 and 24, and ch. 233, sections 7 and 8. Section 1 of the 2005 act, which enacted the section, is effective , and the section is currently in force.
A person or business must disclose a breach of the security of the system, following discovery or notification of the breach, to any Minnesota resident whose unencrypted personal information was or is reasonably believed to have been acquired by an unauthorized person, made in the most expedient time possible and without unreasonable delay.
Unlike Maryland's or Tennessee's fixed-day deadlines, Minnesota uses a reasonableness standard with no numeric cap; a data maintainer that does not own the information must notify the owner immediately upon discovery.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .