Law / United States / 
Minnesota
Minnesota Consumer Data Privacy Act (MCDPA), general applicability
Minn. Stat. §§ 325M.10 to 325M.21
In force since .
A comprehensive regime rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, Data subject residence
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
What it requires
- Limit your collection of a Minnesota resident's personal data to what is adequate, relevant, and reasonably necessary for the purpose you disclosed to them, and obtain consent before processing it for an undisclosed, incompatible secondary purpose.
- Confirm whether you are a postsecondary institution regulated by the Minnesota Office of Higher Education before assuming MCDPA already binds you; that sector's compliance date is , not the general date.
These lines are LexLint's reading of the law's text. Also read by: Office of the Minnesota Attorney General (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such as data uses or retention periods, individuals’ prerogatives with respect to data processing) are established and communicated.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
The Attorney General's privacy site describes itself as a rough guide that simplifies the Act, and states that it is not intended to provide guidance as to how the Office would enforce the Act.
- As of
- Guidance link
- https://www.ag.state.mn.us/Data-Privacy/Business/
- Guidance body
- Office of the Minnesota Attorney General
- Open questions
- Which United States Small Business Administration size standard in 13 CFR part 121 decides whether a controller is a 'small business' excluded from the Act under Minn. Stat. 325M.12, subdivision 2(a)(19), and as of what date is the controller measured against it?
What it makes you log
Who may demand the log
Regulator
What the log must hold
Decision basis
Log retention
Applies to the records of consumer appeals and the controller responses only (325M.14, subd. 5(d)).
- Unit
- Months
- As of
- Basis
- Fixed
- Minimum value
- 24
Logging duty
The Act carries two record duties. A controller must keep records of every consumer appeal and its responses for at least 24 months and give the Attorney General a copy on written request in an investigation (325M.14, subd. 5(d)). A controller must also conduct and document a data privacy and protection assessment for targeted advertising, sale, sensitive data, heightened-risk processing and certain profiling, and must make an assessment available to the Attorney General on a written civil investigative demand (325M.18(b), (f)). The documented description of policies and procedures in 325M.18(a), the data inventory in 325M.16, subd. 2(c) and the controller's documented belief that an opt-out request is fraudulent (325M.14, subd. 4(h)) add to this but are not separate logs. The 24-month figure is the appeals record only; the Act sets no period for assessments. The consumer's right to a list of the third parties that received their data (325M.14, subd. 1(h)) is a right of access to the data, so it sets no access value here. The Act's scope clause (325M.12, subd. 1) applies it to entities that conduct business in Minnesota or target Minnesota residents, and 325M.11(g) defines a consumer as a Minnesota resident.
- Kind
- Explicit
- As of
- Provision
- Minn. Stat. 325M.14, subd. 5(d) (records of appeals), with 325M.18(b) and (f) (documented data privacy and protection assessments)
- Trigger
- personal_data_processing
What this law does
MCDPA governs private-sector processing of Minnesota residents' personal data, enacted as Laws of Minnesota 2024, chapter 121, article 5. A controller must limit collection to what is adequate, relevant, and reasonably necessary for the disclosed processing purpose, and must obtain consent before processing for an undisclosed, incompatible secondary purpose.
The general effective date, , binds every controller except postsecondary institutions regulated by the Office of Higher Education, which are not required to comply until , per the statute's own history note.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .