# Minnesota — US state data breach notification deadlines by state

For Minnesota, statute citation is Minn. Stat. § 325E.61; individual notice deadline is in the most expedient time possible and without unreasonable delay; consumer reporting agency notice trigger (residents) is more than 500 persons at one time; encryption safe harbor is yes; notes is CRA notice must be provided within 48 hours of discovering circumstances requiring notification of more than 500 persons. Financial institutions as defined by 15 U.S.C. § 6809(3) are exempt (Subd. 4). The attorney general enforces this section under Minn. Stat. § 8.31 but no separate AG notification deadline is stated in § 325E.61, recorded from its source on 2026-08-18.

- **State:** Minnesota
- **Statute citation:** Minn. Stat. § 325E.61
- **Individual notice deadline:** in the most expedient time possible and without unreasonable delay _(verified: appears in the quote below)_
- **Consumer reporting agency notice trigger (residents):** more than 500 persons at one time
- **Encryption safe harbor:** yes _(our reading, not quoted from the source)_
- **Notes:** CRA notice must be provided within 48 hours of discovering circumstances requiring notification of more than 500 persons. Financial institutions as defined by 15 U.S.C. § 6809(3) are exempt (Subd. 4). The attorney general enforces this section under Minn. Stat. § 8.31 but no separate AG notification deadline is stated in § 325E.61. _(our reading, not quoted from the source)_

## What the source says

> Any person or business that conducts business in this state, and that owns or licenses data that includes personal information, shall disclose any breach of the security of the system following discovery or notification of the breach in the security of the data to any resident of this state whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure must be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in paragraph (c), or with any measures necessary to determine the scope of the breach, identify the individuals affected, and restore the reasonable integrity of the data system.

## Source

- https://www.revisor.mn.gov/statutes/cite/325E.61

Last verified: 2026-08-18. Review by: 2027-02-14.
Part of [US state data breach notification deadlines by state](https://referencesource.org/data-breach-notification-clocks/).