Data Breach Notice to Residents and State Authorities in Minnesota
At a glance
| Covered entity and service provider | MN business owning/licensing PI notifies residents; nonowner maintainer notifies owner/licensee immediately after discovery (§ 325E.61, subd. 1(a)-(b)) |
|---|---|
| Breach and covered information | Unauthorized acquisition of computerized data; name plus SSN, MN ID/license, or financial-account access; key/password acquisition defeats encryption protection (§ 325E.61, subd. 1(d)-(f)) |
| Risk screen or notice exception | No general risk-of-harm waiver; good-faith employee/agent acquisition without further unauthorized use/disclosure is not breach (§ 325E.61, subd. 1(a),(d)) |
| Individuals who receive notice | MN residents whose unencrypted PI was or is reasonably believed acquired by unauthorized person (§ 325E.61, subd. 1(a)) |
| Individual notice deadline and clock | Most expedient time possible, without unreasonable delay after discovery or notification; no fixed outer day count (§ 325E.61, subd. 1(a)) |
| Regulator threshold and deadline | No general AG breach-report route in § 325E.61; AG enforces the section (§ 325E.61, subds. 1, 2, 6) |
| Consumer-reporting-agency notice | More than 500 persons at one time: all nationwide agencies within 48 hours of discovering notice-triggering circumstances; timing, distribution, content (§ 325E.61, subd. 2) |
| Individual delivery and content | Mail to latest address or qualifying electronic notice; statute requires disclosure of breach, without enumerated letter details (§ 325E.61, subd. 1(a),(g)) |
| Substitute notice conditions and channels | Cost over $250,000, affected class over 500,000, or insufficient contacts: email if available AND website if maintained AND statewide media (§ 325E.61, subd. 1(g)(3)) |
| Delays and alternate compliance | Police may affirmatively delay notice to a date certain; timing-consistent own policy may satisfy notice; defined federal financial institutions exempt (§ 325E.61, subds. 1(c),(h), 4) |
Requirements one by one
Trigger and recipients
Minn. Stat. § 325E.61, subd. 1(a) requires a business operating in Minnesota that owns or licenses personal information to disclose a breach to a resident whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. Subdivision 1(d) defines the breach as unauthorized acquisition of computerized data that compromises the information's security, confidentiality, or integrity. Good-faith employee or agent acquisition for business purposes is excluded if the information is not used or further disclosed without authorization.
The covered elements in subdivision 1(e) are a name with a Social Security number, a driver's license or Minnesota ID number, or financial-account access data. Encryption does not remove the information from the rule if the key, password, or other means to read it was also acquired. Public government-record information is excluded under paragraph (f). A nonowner data maintainer tells the owner or licensee immediately after discovery under paragraph (b).
Clocks and other recipients
Resident disclosure must go in the most expedient time possible and without unreasonable delay following discovery or notification, allowing the stated investigation, identification, restoration, and law-enforcement needs. Section 325E.61, subd. 1(a) sets no fixed outer day limit.
If one incident requires notice to more than 500 people at one time, subdivision 2 requires notice within 48 hours to every nationwide consumer reporting agency, stating the timing, distribution, and content of individual notices. The clock is tied to discovery of circumstances requiring those notices. The section gives no separate general Attorney General breach-report step; subdivision 6 assigns enforcement to that office.
Delivery
Section 325E.61, subd. 1(g) allows writing to the latest available address or qualifying electronic notice. A business may use substitute notice if direct delivery would cost over $250,000, the affected class exceeds 500,000, or contacts are insufficient. The substitute requires email where addresses exist, conspicuous website posting if the business has a site, and major statewide media.
What trips people up
Police delay must be to a date certain. Section 325E.61, subd. 1(c) allows delay only when law enforcement affirmatively determines notice would impede a criminal investigation and sets a certain date.
An internal policy route has timing conditions. Under subdivision 1(h), a business with its own information-security notification procedures is deemed compliant when the procedures are consistent with the statute's timing and it follows them for the breach. Subdivision 4 excludes a federally defined financial institution from the section.
Common questions
Does Minnesota impose a 45-day resident deadline?
Section 325E.61, subd. 1(a) instead requires the most expedient possible disclosure without unreasonable delay, subject to its stated practical and police conditions. It states no 45-day outside limit.
Is a detailed incident letter prescribed?
Subdivision 1(a) requires disclosure of the breach, while paragraph (g) specifies delivery methods. Those provisions do not enumerate a required list of letter contents; subdivision 2 separately specifies what goes to consumer reporting agencies.
Statutes and sources
- Minn. Stat. § 325E.61 — private breach notices, agency coordination, exclusions, and enforcement.
Current official text accessed October 14, 2026.
Source links
Every statute quoted above, linked, with the date we checked it.
What does Minnesota law mean for your facts?
You just read the general rule. Ask your own question and see which parts of current Minnesota law apply to your situation, with citations you can check.
Try Ezel Pro free for 7 days. Cancel anytime before the trial ends and you pay nothing.
- Starts from the statutes this survey is built on
- Cites every source it relies on, so you can verify it
- Chat, drafting and research in one workspace