---
title: "Minnesota privacy law (MCDPA): applicability"
canonical: "https://dposchool.com/state-privacy-laws/state/minnesota/applicability"
source: "https://www.revisor.mn.gov/statutes/cite/325M.10"
text_as_of: "2026-10-28"
last_reviewed: "2026-10-29"
language: "en-US"
publisher: "DPO School"
---

Minnesota Consumer Data Privacy Act

# Minnesota privacy law (MCDPA): applicability

Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review)

## Summary (not the statute text)

The Act applies to legal entities that do business in Minnesota or target its residents and that, in a calendar year, control or process personal data of at least 100,000 consumers (not counting payment-only data), or that earn over 25% of gross revenue from selling personal data and handle data of at least 25,000 consumers. Small businesses as defined by the U.S. Small Business Administration are excluded, except that they may not sell sensitive data without consent. GLBA-regulated data is exempt at data level, while banks, credit unions and insurers are excluded as entities; nonprofits are covered, except insurance-fraud prevention bodies. Postsecondary institutions regulated by the Office of Higher Education have until 31 July 2029.

## Key points

1. Threshold 1: personal data of 100,000 or more consumers in a calendar year, excluding data processed only to complete a payment.

   Section: [§ 325M.12, subd. 1(a)(1)](https://www.revisor.mn.gov/statutes/cite/325M.10)

2. Threshold 2: over 25% of gross revenue from selling personal data and personal data of 25,000 or more consumers.

   Section: [§ 325M.12, subd. 1(a)(2)](https://www.revisor.mn.gov/statutes/cite/325M.10)

3. Data collected, processed, sold or disclosed in compliance with the Gramm-Leach-Bliley Act is exempt (data-level), while state or federally chartered banks, credit unions and their financial affiliates, and insurance companies and producers, are excluded as entities.

   Section: [§ 325M.12, subd. 2(a)(9), (16) and (18)](https://www.revisor.mn.gov/statutes/cite/325M.10)

4. Small businesses under SBA size standards (13 C.F.R. part 121) are excluded but remain subject to § 325M.17.

   Section: [§ 325M.12, subd. 2(a)(19)](https://www.revisor.mn.gov/statutes/cite/325M.10)

5. Government entities and federally recognised Indian tribes are excluded; nonprofits are covered except those set up to detect and prevent insurance fraud.

   Section: [§ 325M.12, subd. 2(a)(1), (2) and (20)](https://www.revisor.mn.gov/statutes/cite/325M.10)

6. Data exemptions include HIPAA protected health information and related health data, FCRA, DPPA, FERPA and Farm Credit Act data, and employment-context data.

   Section: [§ 325M.12, subd. 2(a)(3) to (13)](https://www.revisor.mn.gov/statutes/cite/325M.10)

7. A consumer is a Minnesota resident acting only in an individual or household context.

   Section: [§ 325M.11(g)](https://www.revisor.mn.gov/statutes/cite/325M.10)

## Sources

- [https://www.revisor.mn.gov/statutes/cite/325M.12](https://www.revisor.mn.gov/statutes/cite/325M.12)

[Compare applicability across all states](https://dposchool.com/state-privacy-laws/topic/applicability)

## Status

Law as of October 28, 2026.

[Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed.

[Official text of the Minnesota statute](https://www.revisor.mn.gov/statutes/cite/325M.10)

Reference material, not legal advice.

## Other topics for Minnesota

- [Consumer rights](https://dposchool.com/state-privacy-laws/state/minnesota/consumer-rights)
- [Sensitive data](https://dposchool.com/state-privacy-laws/state/minnesota/sensitive-data)
- [Controller duties](https://dposchool.com/state-privacy-laws/state/minnesota/controller-duties)
- [Processors](https://dposchool.com/state-privacy-laws/state/minnesota/processors)
- [Enforcement](https://dposchool.com/state-privacy-laws/state/minnesota/enforcement)

## Navigation

[US State Privacy Laws](https://dposchool.com/state-privacy-laws) / [Minnesota](https://dposchool.com/state-privacy-laws/state/minnesota) / Applicability

Next: [Consumer rights](https://dposchool.com/state-privacy-laws/state/minnesota/consumer-rights)

Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com).

## For AI agents

- Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt
- JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents