Governance, risk & compliance
Minnesota Consumer Data Privacy Act (MCDPA) Minn. Stat. 325M.10 to 325M.21 (2024)
The Minnesota Consumer Data Privacy Act (Minn.
Stat. 325M.
10 to 325M. 21, 2024 c.
121 art. 5), effective 31 July 2025 (postsecondary institutions regulated by the Office of Higher Education: 31 July 2029).
It applies to a person that does business in Minnesota or targets its residents and handles the data of at least 100,000 consumers, or at least 25,000 consumers while earning more than 25% of gross revenue from sale. Small businesses are excluded except for 325M.
17, which bars the sale of their sensitive data without consent. Consumers can access the categories of data, learn the specific third parties receiving it, and question the result of profiling.
Controllers must honour opt-out preference signals, keep appeal records for 24 months, publish retention policies and a last-updated date in the notice, honour consent revocation within 15 days, get consent for targeted advertising or sale for consumers aged 13 to 16, keep documented privacy policies and a chief privacy officer or equivalent, and run data privacy and protection assessments. The 30-day cure ended on 31 January 2026.
The Attorney General enforces with penalties up to $7,500 per violation; there is no private action. Not verified: (1) The start date of the 325M.
18 assessment duty was not confirmed; check the statute. (2) The 2026 session amended chapter 325M (ch.
111, social media provisions 325M. 33 and 325M.
40); those separate social media rules are not part of this framework and were not read in detail. (3) Penalty is stated from 325M.
20 as read; confirm against the current statute. General information for compliance work, not legal advice.
Assessment tiers & levels Lavawall supports
Lavawall assesses Minnesota Consumer Data Privacy Act (MCDPA) at every level below, so you can start where you are and step up as your program matures.
| Tier / level | What it covers | Builds on lower |
|---|---|---|
| Controller | A person that, alone or jointly with others, determines the purpose and means of processing personal data and meets the applicability test in 325M.12 (100,000 consumers, or 25,000 with more than 25% of revenue from sale). Carries the notice, consumer rights, consent, security, assessment and enforcement duties. | — |
| Processor | A person that processes personal data on behalf of a controller (325M.13). Must follow the controller’s instructions, help with consumer requests and security, give assessment information, bind its people and subcontractors, and delete or return data at the end of the service. A processor that decides purposes and means is treated as a controller. | — |
| Small business | A business that meets the federal Small Business Administration definition. The Act otherwise excludes it, but 325M.17 still bars it from selling sensitive data without the consumer’s prior consent. | — |
How Lavawall® helps you get to Minnesota Consumer Data Privacy Act (MCDPA) compliance
Most of Minnesota Consumer Data Privacy Act (MCDPA) comes down to technical controls you have to run and prove: keeping systems patched, hardening configuration, detecting breaches early, backing up what matters, controlling access, and keeping evidence that all of it actually happened. Lavawall® runs those controls across Windows, macOS, Linux, and Microsoft 365 / Google Workspace from one console, maps them to Minnesota Consumer Data Privacy Act (MCDPA), and tracks your posture continuously instead of once a year at audit time.
- Assess your current state against Minnesota Consumer Data Privacy Act (MCDPA) in the Lavawall GRC module, with the questionnaire and control set built in.
- Remediate the gaps with the same platform — automated patching, configuration fixes, backups, and access review — not a separate project.
- Evidence everything with timestamped, exportable records auditors, insurers, and clients accept.
Related
Lavawall® supports Minnesota Consumer Data Privacy Act (MCDPA) as part of a built-in catalogue of compliance frameworks. Framework requirements are summarized for planning purposes; always confirm the current official text before certifying.
At a glance
- Framework
- Minnesota Consumer Data Privacy Act (MCDPA) Minn. Stat. 325M.10 to 325M.21 (2024)
- Category
- Privacy
- Region
- USA - Minnesota
- Levels
- 3 assessment tiers
All Minnesota, United States frameworks and training →
Map this framework freeTalk to our team