DPO SchoolDPO School

Minnesota Consumer Data Privacy Act

Minnesota privacy law (MCDPA): processors

Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026

Summary (not the statute text)

Processors must follow controller instructions and help with rights requests, security, breach notification and assessments. A binding contract must set out instructions, nature and purpose, data types, duration and both parties' rights and obligations, and require confidentiality, subcontracting only after a chance to object, deletion or return, compliance information and assessments (or an annual independent assessment). A processor that decides purposes and means becomes a controller.

Key points

  1. Processors must assist with rights requests, security and breach notification, and assessments.

    Section: § 325M.13(b)

  2. The contract must set out instructions, nature and purpose, data types, duration and both parties' rights and obligations.

    Section: § 325M.13(c) and (e)

  3. Confidentiality duty for every person processing data; subcontractors only after the controller can object and under written contracts.

    Section: § 325M.13(c)(1) and (2)

  4. Deletion or return at the end of services, compliance information on request, and assessments by the controller or an annual independent assessment at the processor's expense.

    Section: § 325M.13(e)(1) to (3)

  5. No contract relieves either party of its liabilities; status is decided on the facts.

    Section: § 325M.13(f) and (g)

Sources

Compare processors across all states

Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

Law as of October 28, 2026.

Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.

Official text of the Minnesota statute

Reference material, not legal advice.