Minnesota Cybersecurity and Privacy Regulations: What Applies to Your Business

Minnesota does not have a single cybersecurity law for businesses. It has a breach notification statute that has been on the books since 2006, a consumer privacy law that took effect in July 2025, a payment card data law, health and insurance rules for specific sectors, and the federal rules that apply regardless of state. A business owner in Minneapolis or anywhere in the state needs to know which of these apply, what each actually asks for, and what the overlap is in IT terms. This article lays that out without the legal fog.

The breach notification statute (Minn. Stat. 325E.61)

This is the law that applies to every business holding Minnesotans’ personal information. Personal information means a first name or initial and last name together with a Social Security number, driver’s license or state ID number, or an account or card number with the code needed to use it. If that data is acquired by an unauthorized person, the business must notify affected residents in the most expedient time possible and without unreasonable delay. If more than 500 residents are notified, the major consumer reporting agencies must be told within 48 hours of the consumer notices. Minnesota’s general statute does not require notice to the Attorney General or any state agency, which makes it lighter than many states on paper, but the “without unreasonable delay” standard is enforced, and the Attorney General can act under consumer protection law. Encrypted data is excluded provided the key was not also taken, and a vendor holding data for you must notify you immediately after discovering a breach.

The Minnesota Consumer Data Privacy Act (effective July 31, 2025)

The MCDPA is Minnesota’s comprehensive privacy law. It applies to businesses that, in a calendar year, process personal data of 100,000 or more Minnesota consumers, or process data of 25,000 or more and derive more than 25 percent of revenue from selling personal data. Most businesses of 10 to 200 people are below those thresholds, and the law also exempts small businesses as defined by the Small Business Administration (with one exception: they may not sell sensitive data without consent). If you are over the thresholds, the obligations are substantial: a data inventory, a privacy notice, consumer rights to access, correct, delete, and port their data, opt-outs for targeted advertising and sales, data protection assessments for higher-risk processing, contracts with processors, and reasonable security. Enforcement is by the Attorney General at up to $7,500 per violation; the 30-day cure period expired January 31, 2026. There is no private right of action.

The reason a smaller business should still read the MCDPA: it tells you what “reasonable” looks like to Minnesota regulators, and larger customers subject to it will push its requirements into vendor contracts.

Sector rules that apply in Minnesota

What all of them have in common

None of these laws hands a business a product list. They set an outcome, usually “reasonable security,” and look at what the business did when something goes wrong. Across every regulator, insurer, and court, the same controls define reasonable for a small business:

• Know where personal data is. An inventory of systems, folders, mailboxes, and vendors. The MCDPA requires it explicitly; the breach statute makes it necessary in practice.
• Encrypt every device. The encryption exclusion in 325E.61 is the difference between a lost laptop and a notification.
• Multi-factor authentication everywhere, starting with email.
• Endpoint detection and response with 24/7 monitoring, so you can detect an incident and show what was and was not accessed.
• Immutable, tested backups. See how often to back up your business data.
• Vendor contracts that require prompt breach notice and the same standard of care.
• Retention and secure disposal, including for card data you should not have kept.
• A written incident response plan with the clocks for each rule that applies to you.

How Corporate Technologies helps Minnesota businesses

We are headquartered in Eden Prairie and support businesses across the state; see managed IT services in Minneapolis and Minneapolis cybersecurity services. The controls above are what our Secure Advantage package delivers, with encryption and backups through our managed IT plans, and our 24/7 help desk and security operations center are shared across all 21 of our locations. If you want to see where you stand first, the network health check takes about three minutes.

This article is general information about Minnesota and federal rules, not legal advice. Whether the MCDPA applies to your business, and how to respond to a specific incident, are questions for counsel.

Frequently asked questions

We have 30 employees. Does the Minnesota Consumer Data Privacy Act apply to us?

Probably not, unless you process data on 100,000 or more Minnesota consumers a year or sell personal data at scale. Small businesses under the SBA definition are exempt in any case, except for selling sensitive data. Your larger customers may still require MCDPA-style terms in contracts.

Do we have to tell the state about a breach?

Not under the general breach statute. You must notify affected individuals without unreasonable delay and, if more than 500 are notified, the consumer reporting agencies within 48 hours. Sector rules (HIPAA, insurance, FTC Safeguards) have their own agency notices.

Is an encrypted lost laptop a breach under Minnesota law?

Generally not, if the data was encrypted and the key was not compromised. This requires full-disk encryption turned on, not just a login password.

What is the single most useful thing to do first?

Turn on multi-factor authentication for every account, then encrypt every device. Those two steps close the entry point for most incidents and remove most lost-device notifications, and they cost almost nothing.