DPO SchoolDPO School

Minnesota Consumer Data Privacy Act

Minnesota privacy law (MCDPA): applicability

Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026

Summary (not the statute text)

The Act applies to legal entities that do business in Minnesota or target its residents and that, in a calendar year, control or process personal data of at least 100,000 consumers (not counting payment-only data), or that earn over 25% of gross revenue from selling personal data and handle data of at least 25,000 consumers. Small businesses as defined by the U.S. Small Business Administration are excluded, except that they may not sell sensitive data without consent. GLBA-regulated data is exempt at data level, while banks, credit unions and insurers are excluded as entities; nonprofits are covered, except insurance-fraud prevention bodies. Postsecondary institutions regulated by the Office of Higher Education have until 31 July 2029.

Key points

  1. Threshold 1: personal data of 100,000 or more consumers in a calendar year, excluding data processed only to complete a payment.

    Section: § 325M.12, subd. 1(a)(1)

  2. Threshold 2: over 25% of gross revenue from selling personal data and personal data of 25,000 or more consumers.

    Section: § 325M.12, subd. 1(a)(2)

  3. Data collected, processed, sold or disclosed in compliance with the Gramm-Leach-Bliley Act is exempt (data-level), while state or federally chartered banks, credit unions and their financial affiliates, and insurance companies and producers, are excluded as entities.

    Section: § 325M.12, subd. 2(a)(9), (16) and (18)

  4. Small businesses under SBA size standards (13 C.F.R. part 121) are excluded but remain subject to § 325M.17.

    Section: § 325M.12, subd. 2(a)(19)

  5. Government entities and federally recognised Indian tribes are excluded; nonprofits are covered except those set up to detect and prevent insurance fraud.

    Section: § 325M.12, subd. 2(a)(1), (2) and (20)

  6. Data exemptions include HIPAA protected health information and related health data, FCRA, DPPA, FERPA and Farm Credit Act data, and employment-context data.

    Section: § 325M.12, subd. 2(a)(3) to (13)

  7. A consumer is a Minnesota resident acting only in an individual or household context.

    Section: § 325M.11(g)

Sources

Compare applicability across all states

Law as of October 28, 2026.

Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.

Official text of the Minnesota statute

Reference material, not legal advice.