Minnesota Data Breach Notification Law
MN Breach Notification
Breach notification
Requires businesses to notify Minnesota residents whose unencrypted personal information (name plus SSN, driver's license or state ID number, or financial account or card number with its access code) was, or is reasonably believed to have been, acquired by an unauthorized person, in the most expedient time possible and without unreasonable delay. Service providers must notify the data owner immediately, and breaches affecting more than 500 people require notice to the nationwide consumer reporting agencies within 48 hours.
- Where
- Minnesota
- Citation
- Minn. Stat. 325E.61
- Status
- In force
- In force since
- 2006-01-01
- Enforced by
- Minnesota Attorney General under 8.31 (325E.61, subd. 6)
- People can sue
- No
- Penalties
- Enforced by the Attorney General under Minn. Stat. 8.31 (injunctions, civil penalties, and other remedies available under that statute); waivers are void (subds. 3, 6). The statute does not expressly create a private right of action.
- Applies to
- Any person or business that conducts business in Minnesota and owns, licenses, or maintains computerized data that includes personal information of Minnesota residents (325E.61, subd. 1)
- Exempt: financial institutions as defined in 15 U.S.C. 6809(3) (GLBA) (subd. 4)
- Government entities are covered by the parallel provision in 13.055, subd. 6
Breach duties
- Notify affected Minnesota residents of a breach of unencrypted personal information in the most expedient time possible and without unreasonable delay, subject to law enforcement delay and time needed to scope the breach and restore system integrity.Minn. Stat. 325E.61, subd. 1(a), (c)
- A person maintaining data it does not own must notify the owner or licensee immediately after discovering a breach.Minn. Stat. 325E.61, subd. 1(b)
- Notice may be written, electronic (if the primary method of communication or E-SIGN compliant), or substitute notice (email, website posting, and statewide media) if cost exceeds $250,000, more than 500,000 people are affected, or contact information is lacking; an entity following its own consistent notification policy is deemed compliant.Minn. Stat. 325E.61, subd. 1(g)-(h)
- If more than 500 persons must be notified at one time, notify all nationwide consumer reporting agencies within 48 hours of the timing, distribution, and content of the notices.Minn. Stat. 325E.61, subd. 2 · Only if: Breaches requiring notice to more than 500 persons at one time
Sources
- Official text
- Minn. Stat. 325E.61, 2025 Minnesota Statutes (Office of the Revisor of Statutes)
- Laws 2005, ch. 167 (effective January 1, 2006)
Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.
Unverified: No Attorney General notification requirement exists in the statute text; confirmed by reading 325E.61 as of the 2025 Statutes, but 2026 session laws affecting 325E.61 were not listed on the revisor page.
Research reference, not legal advice.