Minnesota Consumer Data Privacy Act (MCDPA)
Complete compliance guide for companies with <200 employees. Everything you need to know about MCDPA requirements, deadlines, and penalties.
45 calendar days
+ 45 days extension
$7,500/violation
Up to $7,500 per violation under the Minnesota consumer protection statutes. A 30-day cure period applies until January 31, 2026, after which the Attorney General may proceed directly with enforcement.
100,000 consumers
$4,500 – $16,000
4-12 weeks
Mid-Market Compliance Guide
Minnesota's MCDPA is notable for including a right to question profiling decisions — a feature more commonly found in GDPR than in US state privacy laws. It applies to nonprofits (unlike most states) and the threshold is 100,000+ consumers or 25,000+ consumers with 25%+ revenue from data sales. The 30-day cure period is temporary, expiring January 31, 2026.
Key Requirements
- Provide a clear and accessible privacy notice
- Limit data collection to what is adequate, relevant, and necessary
- Obtain consent before processing sensitive data
- Conduct data protection assessments for high-risk processing
- Implement and maintain reasonable data security practices
- Provide consumers the right to question profiling decisions
Consumer Rights
Business Obligations
- 1.Provide privacy notice with required disclosures
- 2.Respond to consumer requests within 45 days
- 3.Provide an appeals process for denied requests
- 4.Execute data processing agreements with processors
- 5.Implement reasonable data security measures
- 6.Provide meaningful information about profiling logic
Exemptions
- •HIPAA-covered entities and data
- •GLBA-covered financial institutions
- •Higher education institutions
- •Government entities
Related Privacy Laws
Recommended Compliance Tools
No vendors have been reviewed for MCDPA coverage yet.
Browse all compliance toolsGet a mid-market compliance checklist for MCDPA
We'll send you a practical, step-by-step checklist tailored for companies with <200 employees. No spam, unsubscribe anytime.
See how DPAs enforce MCDPA in practice
Real fines, real violations, real lessons. Browse our enforcement database to understand what gets penalized under MCDPA.
Disclaimer: This is general information, not legal advice. Consult a qualified attorney for your specific situation. Laws and regulations may change. Last reviewed: 3/3/2026.