--- title: "Minnesota privacy law (MCDPA): controller duties" canonical: "https://dposchool.com/state-privacy-laws/state/minnesota/controller-duties" source: "https://www.revisor.mn.gov/statutes/cite/325M.10" text_as_of: "2026-10-28" last_reviewed: "2026-10-29" language: "en-US" publisher: "DPO School" --- Minnesota Consumer Data Privacy Act # Minnesota privacy law (MCDPA): controller duties Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review) ## Summary (not the statute text) Controllers must publish a privacy notice that also states retention policies and the date of the last update, provide an opt-out link outside the notice, and notify consumers of material changes. They must limit collection to what is adequate, relevant and reasonably necessary, delete data no longer needed, and keep reasonable security, including an inventory of the data they manage. They must document their privacy policies and procedures (naming a chief privacy officer or responsible person) and conduct data privacy and protection assessments for high-risk processing. Since 31 July 2025 they must honour universal opt-out signals for targeted advertising and sale. ## Key points 1. Privacy notice: data categories and purposes, rights and appeals, data and third parties sold to or shared with, contact details, retention policies, and the date last updated; posted through a 'privacy' link. Section: [§ 325M.16, subd. 1(a) and (g)](https://www.revisor.mn.gov/statutes/cite/325M.10) 2. A clear opt-out method outside the privacy notice is required where the controller sells data, targets ads or profiles for significant decisions. Section: [§ 325M.16, subd. 1(b)](https://www.revisor.mn.gov/statutes/cite/325M.10) 3. Collection limited to what is adequate, relevant and reasonably necessary; no retention once data is no longer relevant and reasonably necessary. Section: [§ 325M.16, subd. 2(a) and (g)](https://www.revisor.mn.gov/statutes/cite/325M.10) 4. Reasonable security practices, including maintaining an inventory of the data. Section: [§ 325M.16, subd. 2(c)](https://www.revisor.mn.gov/statutes/cite/325M.10) 5. Universal opt-out signals for targeted advertising and sale must be honoured; an IP address is enough to estimate residence. Section: [§ 325M.14, subd. 3](https://www.revisor.mn.gov/statutes/cite/325M.10) 6. Written description of privacy policies and procedures, naming a chief privacy officer or other responsible person. Section: [§ 325M.18(a)](https://www.revisor.mn.gov/statutes/cite/325M.10) 7. Data privacy and protection assessments for targeted advertising, sale, sensitive data, risky profiling and other heightened-risk processing. Section: [§ 325M.18(b)](https://www.revisor.mn.gov/statutes/cite/325M.10) ## Sources - [https://www.revisor.mn.gov/statutes/cite/325M.16](https://www.revisor.mn.gov/statutes/cite/325M.16) - [https://www.revisor.mn.gov/statutes/cite/325M.18](https://www.revisor.mn.gov/statutes/cite/325M.18) - [https://www.revisor.mn.gov/statutes/cite/325M.14](https://www.revisor.mn.gov/statutes/cite/325M.14) [Compare controller duties across all states](https://dposchool.com/state-privacy-laws/topic/controller-duties) ## Related GDPR articles Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions. - [Article 35: Data protection impact assessment](https://dposchool.com/gdpr/article/35) (assessments) ## Status Law as of October 28, 2026. [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed. [Official text of the Minnesota statute](https://www.revisor.mn.gov/statutes/cite/325M.10) Reference material, not legal advice. ## Other topics for Minnesota - [Applicability](https://dposchool.com/state-privacy-laws/state/minnesota/applicability) - [Consumer rights](https://dposchool.com/state-privacy-laws/state/minnesota/consumer-rights) - [Sensitive data](https://dposchool.com/state-privacy-laws/state/minnesota/sensitive-data) - [Processors](https://dposchool.com/state-privacy-laws/state/minnesota/processors) - [Enforcement](https://dposchool.com/state-privacy-laws/state/minnesota/enforcement) ## Navigation [US State Privacy Laws](https://dposchool.com/state-privacy-laws) / [Minnesota](https://dposchool.com/state-privacy-laws/state/minnesota) / Controller duties Previous: [Sensitive data](https://dposchool.com/state-privacy-laws/state/minnesota/sensitive-data) Next: [Processors](https://dposchool.com/state-privacy-laws/state/minnesota/processors) Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com). ## For AI agents - Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt - JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents