Minnesota Data Breach Notification Law

The Minnesota data breach notification law in brief

Minn. Stat. § 325E.61 measures time by a standard rather than a calendar: the most expedient time possible and without unreasonable delay ¹. Police can ask for a hold, and the business may take the time it needs to learn how far the breach went and get systems working again. Nothing is filed with the Attorney General.

Two details make this statute stricter than it first looks. There is no risk-of-harm exception, and the bureau deadline is counted in hours: 48 of them, triggered when more than 500 people are notified at one time ¹.

No harm analysis: acquisition is enough

Any unauthorized acquisition of covered data that compromises its security, confidentiality or integrity requires notice ¹. A business cannot investigate, decide misuse is unlikely and stay quiet, as it could in neighboring Wisconsin or Iowa. Any waiver of the statute is void, so a customer contract cannot sign the duty away.

In practice, if an attacker downloads a payroll file with employee Social Security numbers, the employees get letters even when nothing suggests the data has been used yet.

Encryption is close to the only exit. Records secured so they are unreadable or unusable are exempt, but that protection falls away if the thief also got the key or another way to read them ¹.

Who else the law reaches

Firms that only hold data on a client's behalf, such as a payroll processor, owe that client a warning immediately after they discover a breach ¹. Banks and other institutions under the Gramm-Leach-Bliley Act sit outside § 325E.61 and follow federal rules. Clinics juggle a second deadline, since federal health rules allow at most 60 calendar days after discovery for patient letters ²; our overview of HIPAA breach letters shows how the two overlap.

A separate privacy statute sits alongside it. Since July 31, 2025, the Minnesota Consumer Data Privacy Act has applied to companies processing data on 100,000 or more Minnesota consumers a year, or on 25,000 or more when over 25% of gross revenue comes from selling personal data ³. SBA-defined small businesses are outside most of it, but even they need prior consent before selling sensitive data.

Attorney General enforcement in Minnesota

Enforcement runs through Minn. Stat. § 8.31, the Attorney General's general power to seek injunctions and civil penalties of up to $25,000 ¹⁴. That same section gives injured people a lawsuit for violations of laws on its list; § 325E.61 is missing from the list, which leaves private breach suits an open question. For scale, IC3 logged 13,595 complaints from Minnesotans in 2025 ⁵.

The first 48 hours and after

If the intruder is still active, the insured firm's first phone call goes to its carrier, the second is an IC3 complaint for the FBI, and servers stay untouched until a forensic copy exists ⁶⁷⁸.

With only 48 hours for the bureaus, draft their notice at the same time as the resident letters whenever the count could pass 500. A forensic response firm or your own IT staff stops the attack and builds the list of people by state, and the side-by-side breach deadlines show what each of those states wants. Policy conditions are covered in what carriers require. Twin Cities businesses can compare local support in our Minneapolis managed IT guide.

Text of § 325E.61 as of October 13, 2026 is what we summarized here. General information like this is not legal advice, and a Minnesota lawyer should confirm what applies to you.