MN · Breach notification statute
Minnesota data breach notification law
Summary
- Statute citation
This state has 2 separate breach notification statutes
Private Sector: Minn. Stat. § 325E.61 (Trade Practices - Data Breach Notification) (amended
- Source
- PRC Data Breach Notification Laws Survey 2026
Who must notify and when
Most expedient time possible and without unreasonable delay Minnesota requires businesses and
Attorney general notice
No Minnesota does not require breach notification to the Attorney General or any state agency. 44
What counts as a breach
Not extracted in our PRC 2026 summary; check the statute.
What counts as personal information
Not extracted in our PRC 2026 summary; check the statute.
Coverage and remedies
"Not extracted" means the field was not captured in our PRC 2026 summary; check the statute.
HIPAA breaches reported in Minnesota
194 reports to HHS OCR affecting 212,076,397 individuals. Most common type: Hacking/IT Incident. See all HIPAA breaches in Minnesota.
Five largest
| Covered entity | Entity type | Individuals | Submitted | Type of breach | Status |
|---|---|---|---|---|---|
| Change Healthcare, Inc. | Business Associate | 192,700,000 | Jul 19, 2024 | Hacking/IT Incident | Archive (closed) |
| Optum360, LLC | Business Associate | 11,500,000 | Jul 1, 2019 | Hacking/IT Incident | Archive (closed) |
| Pension Benefit Information, LLC | Business Associate | 1,866,694 | Jul 14, 2023 | Hacking/IT Incident | Archive (closed) |
| MNGI Digestive Health, PA | Healthcare Provider | 767,670 | Oct 24, 2023 | Hacking/IT Incident | Archive (closed) |
| Radius Global Solutions | Business Associate | 632,204 | Aug 4, 2023 | Hacking/IT Incident | Archive (closed) |
Frequently asked questions
When must Minnesota businesses notify individuals of a data breach?
Our PRC 2026 extract summarises the Minnesota timing rule as: "Most expedient time possible and without unreasonable delay Minnesota requires businesses and". (Source: PRC 2026 survey extract.)
Does Minnesota require notice to the attorney general?
The PRC 2026 extract notes: "No Minnesota does not require breach notification to the Attorney General or any state agency. 44". (Source: PRC 2026 survey extract.)
Does the Minnesota law cover biometric data?
No. The PRC 2026 survey does not record biometric data as covered by the Minnesota breach law.
Does the Minnesota law cover medical information?
No. The PRC 2026 survey does not record medical information as covered by the Minnesota breach law.
Does the Minnesota law cover paper records?
No. The PRC 2026 survey records the Minnesota law as covering computerised data only, not paper records.
Is there a private right of action in Minnesota?
Yes. The PRC 2026 survey records a private right of action under the Minnesota breach law.
Is credit monitoring required in Minnesota?
No. The PRC 2026 survey does not record a credit monitoring requirement in Minnesota.
How does the Minnesota law relate to HIPAA?
HIPAA covered entities and business associates follow the federal HIPAA Breach Notification Rule for protected health information. State breach laws can apply alongside it, and some state statutes treat HIPAA compliance as satisfying state duties. Check the Minnesota statute, and see our HIPAA vs state breach notification laws guide.
Sources
- Privacy Rights Clearinghouse, Data Breach Notification Laws Survey 2026 (laws as of 1 January 2026): privacyrights.org
- The Minnesota state legislature website for the current text of the statute.
- HHS OCR Breach Portal: ocrportal.hhs.gov
- Further reading: NCSL security breach notification laws