1. Home
  2. State breach laws
  3. Minnesota

Minnesota data breach notification law

What Minnesota requires when personal information is exposed: how fast residents must be notified, when the Attorney General has to be told, what it costs to get it wrong, and whether affected people can sue. Governed by Minn. Stat. § 325E.61.

No fixed deadline
Notification deadline
Not required
AG notification
No
Private right of action
None
Liability protection

What this means if you sell security services

Minnesota sets no fixed deadline, only "without unreasonable delay," so filings can land weeks after discovery, often after the organization has finished its first response and started asking what to do differently. There is no Attorney General notice requirement, so Minnesota incidents surface mainly through SEC and HHS filings and through other states' records, channels fewer competitors watch. The law itself gives individuals no right to sue, so the conversation centers on regulator penalties and remediation rather than lawsuits.

See recent Minnesota breach filings →

Requirements in detail

Statute
Minn. Stat. § 325E.61
Deadline to notify residents
In the most expedient time possible and without unreasonable delay, consistent with law enforcement needs and any steps needed to determine the scope of the breach and restore the system. There is no fixed number of days.
Attorney General notification
No. Businesses are not required to notify the Attorney General. If more than 500 people must be notified at one time, the business must notify the nationwide consumer reporting agencies within 48 hours of the timing, distribution, and content of the notices.
Penalties
The Attorney General enforces the law under Minnesota Statutes section 8.31, which allows injunctive relief and a civil penalty of up to $25,000 as set by a court.
Private right of action
No. The breach notification law itself doesn't give individuals a right to sue; the Attorney General enforces it. People can still bring other claims after a breach, such as negligence.
Encryption exemption
Minnesota's notification requirements apply to unencrypted personal information. Encrypted data generally doesn't trigger notice unless the encryption key or credentials were also compromised.
Liability protection for security programs
None. Minnesota has no law limiting breach lawsuits for organizations that maintain a security program.
Recent changes
None to the breach notification law, which was last amended in 2006. Separately, the Minnesota Consumer Data Privacy Act (sections 325M.10 to 325M.21) took effect July 31, 2025. It is a privacy law, not a change to the breach notification statute.

Minnesota breach notification FAQ

What is the data breach notification deadline in Minnesota?

In the most expedient time possible and without unreasonable delay, consistent with law enforcement needs and any steps needed to determine the scope of the breach and restore the system. There is no fixed number of days. The governing law is Minn. Stat. § 325E.61.

Does Minnesota require notifying the Attorney General of a data breach?

No. Businesses are not required to notify the Attorney General. If more than 500 people must be notified at one time, the business must notify the nationwide consumer reporting agencies within 48 hours of the timing, distribution, and content of the notices.

What are the penalties for failing to report a data breach in Minnesota?

The Attorney General enforces the law under Minnesota Statutes section 8.31, which allows injunctive relief and a civil penalty of up to $25,000 as set by a court.

Can individuals sue over a data breach in Minnesota?

No. The breach notification law itself doesn't give individuals a right to sue; the Attorney General enforces it. People can still bring other claims after a breach, such as negligence.

Does encrypted data need to be reported in Minnesota?

Minnesota's notification requirements apply to unencrypted personal information. Encrypted data generally doesn't trigger notice unless the encryption key or credentials were also compromised.

Does Minnesota limit breach lawsuits for companies with a cybersecurity program?

No. Minnesota has no law limiting breach lawsuits for organizations that maintain a security program.

Last reviewed October 5, 2026. This summary is for general information and is not legal advice. Statutes change; confirm current requirements with counsel or the Minnesota Attorney General before relying on them.

Other states with a no fixed deadline

Breach notification laws by state

Compare all 51 jurisdictions on the interactive map →·US data breach statistics →