Minnesota's Data Breach Notification Law: Section 325E.61 and Its Government Counterpart, Section 13.055
Key Takeaways
- Section 325E.61 applies to any person or business conducting business in Minnesota that owns or licenses data including personal information, and requires notice to each affected resident in the most expedient time possible and without unreasonable delay
- There is no risk-of-harm exception: notice turns on whether unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person, and encrypted data counts as unsecured if the key or password was also acquired
- A person who must notify more than 500 persons at one time must notify the nationwide consumer reporting agencies within 48 hours; no notice to the Attorney General is required, and GLBA financial institutions are exempt from the section
- Government entities follow section 13.055 instead, which adds an investigation report, a 1,000-person credit bureau threshold without a fixed hour count, and an annual security assessment
- The Attorney General enforces the section through section 8.31, and in the 2019 Medical Informatics Engineering settlement the office alleged a nearly two-month notice delay violated the expedient-notice requirement
What Minn. Stat. § 325E.61 Covers
Section 325E.61 carries the heading "Data warehouses; notice required for certain disclosures." Its history line lists only three session laws: 2005 chapter 167, and two 2006 chapters (212 and 233). Unlike most state breach statutes, it has not been rewritten since, and as retrieved on October 19, 2026 it reads largely as it did in 2006.
Subdivision 1(a) sets the duty for an entity that "owns or licenses data that includes personal information": after discovery or notification of a breach, it "shall disclose any breach of the security of the system" to "any resident of this state whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person." Subdivision 1(b) sets a separate duty for an entity that maintains data it does not own: it must notify the owner or licensee "immediately following discovery." The two duties use different timing words, and only the second uses "immediately."
Three definitions govern what triggers the duty:
- Breach of the security of the system (paragraph (d)) means "unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information." Good faith acquisition by an employee or agent for the business's purposes is excluded if the information is not used or further disclosed without authorization.
- Personal information (paragraph (e)) means a first name or first initial and last name together with a Social Security number, a driver's license or Minnesota identification card number, or an account, credit or debit card number "in combination with any required security code, access code, or password that would permit access to an individual's financial account."
- Publicly available information lawfully made available from government records is excluded (paragraph (f)).
The element list is short by current standards. It contains no medical or health insurance information, no biometric data, and no online credentials such as a username and password on their own. A breach of those categories alone, without one of the three listed elements, falls outside the section's definition.
There is also no risk-of-harm exception. Michigan's statute, by contrast, lets an entity skip notice if it determines a breach is not likely to cause substantial loss or injury (see the post on MCL 445.72). Section 325E.61 turns only on acquisition, actual or reasonably believed.
The Notice Deadline and Law Enforcement Delay
Minnesota sets no day count. Subdivision 1(a) requires disclosure "in the most expedient time possible and without unreasonable delay," consistent with "the legitimate needs of law enforcement" or "any measures necessary to determine the scope of the breach, identify the individuals affected, and restore the reasonable integrity of the data system." Tennessee, in contrast, caps the period at 45 days (see the post on § 47-18-2107).
The law enforcement delay in paragraph (c) is drafted narrowly. Notice "may be delayed to a date certain if a law enforcement agency affirmatively determines that the notification will impede a criminal investigation." Two features stand out in the text: the agency must make an affirmative determination, and the delay runs to a date certain rather than open-endedly.
Paragraph (g) allows written notice to the most recent address on file, electronic notice where the entity's primary method of communication is electronic or the notice complies with the federal E-SIGN Act, or substitute notice where cost would exceed $250,000, more than 500,000 people are affected, or contact information is insufficient. Substitute notice requires all of email notice where addresses are available, a conspicuous website posting, and notification to major statewide media. Paragraph (h) deems an entity compliant if it follows its own notification procedures in an information security policy that is "otherwise consistent with the timing requirements" of the section.
The section prescribes no content for the notice. It does not require a description of the incident, the types of information involved or a telephone number for assistance, all of which Michigan's statute lists.
Notice to Consumer Reporting Agencies Within 48 Hours
Subdivision 2 is the only provision of section 325E.61 with a fixed clock. If a person "discovers circumstances requiring notification under this section and section 13.055, subdivision 6, of more than 500 persons at one time," it "shall also notify, within 48 hours, all consumer reporting agencies that compile and maintain files on consumers on a nationwide basis" of "the timing, distribution, and content of the notices."
The section contains no duty to notify the Attorney General or any other state agency. The consumer reporting agencies are the only third parties it names. Under subdivision 3, any waiver of the section "is contrary to public policy and is void and unenforceable."
The Encryption Clause and the Financial Institution Exemption
The encryption rule is written into the definition of personal information rather than as a separate safe harbor. A data element counts only "when the data element is not secured by encryption or another method of technology that makes electronic data unreadable or unusable, or was secured and the encryption key, password, or other means necessary for reading or using the data was also acquired." The statute names no technical standard; the test is whether the method makes the data unreadable or unusable. Tennessee's statute, by comparison, names FIPS 140-2.
Subdivision 4 removes a whole class of entities: "This section and section 13.055, subdivision 6, do not apply to any 'financial institution' as defined by United States Code, title 15, section 6809(3)," which is the Gramm-Leach-Bliley Act definition. The exemption is entity-based; the section does not condition it on the institution having its own notice program.
Government Entities Under Section 13.055
Section 325E.61 refers throughout to "section 13.055, subdivision 6." Its own subdivision 5 is marked "[Renumbered 13.055, subd 6]," which indicates where the government provision originally came from. In the current text of section 13.055 (amended in 2014 according to its history line), subdivision 6 is headed "Security assessments" and requires each government entity to conduct, at least annually, "a comprehensive security assessment of any personal information," using the section 325E.61 definition of personal information. The breach notice duty for government entities now sits in subdivision 2.
The government rules differ from the private rules in several ways:
| Feature | § 325E.61 (businesses) | § 13.055 (government entities) |
|---|---|---|
| Data covered | Name plus SSN, license or ID number, or financial account with access code | Private or confidential data on individuals |
| Breach definition | Unauthorized acquisition compromising security, confidentiality or integrity | Unauthorized acquisition compromising security and classification of the data |
| Timing | Most expedient time possible, without unreasonable delay | Most expedient time possible, without unreasonable delay |
| Law enforcement delay | To a date certain, on an affirmative determination | While notice would impede an active criminal investigation |
| Credit bureau notice | More than 500 persons, within 48 hours | More than 1,000 individuals, without unreasonable delay |
| Investigation report | None | Required after the investigation and any discipline concludes |
For government entities, subdivision 2(b) requires a report on the facts and results of the investigation, and where the breach involved access or acquisition by an employee, contractor or agent, the report must include the type of data, the number of individuals affected and, after final disciplinary disposition, the name of each responsible employee. The individual notice must tell recipients that the report will be prepared and how to obtain it.
Enforcement by the Attorney General
Subdivision 6 of section 325E.61 states: "The attorney general shall enforce this section and section 13.055, subdivision 6, under section 8.31." Section 8.31 gives the office investigative tools (interrogatories, document demands and depositions under subdivision 2), authority to accept a court-filed assurance of discontinuance (subdivision 2b), and the right to seek injunctive relief and a civil penalty "not in excess of $25,000" (subdivision 3).
Section 8.31, subdivision 3a, also provides that "any person injured by a violation of any of the laws referred to in subdivision 1 may bring a civil action." Section 325E.61 is not among the statutes listed by name in subdivision 1, and neither text says whether routing enforcement "under section 8.31" carries the subdivision 3a remedy with it. No Minnesota appellate decision resolving the point was retrieved for this post. The contrast with the state's comprehensive privacy law is textual: section 325M.20(d) expressly excludes any private action "including under section 8.31, subdivision 3a."
Two Attorney General releases tie enforcement to the notice duty. In the May 30, 2019 settlement with Medical Informatics Engineering, a 16-state case filed in federal court in Indiana under HIPAA and state law, the office stated that the company waited "nearly two months before it began notifying patients," which it described as a violation of "state law that requires companies to begin the notification process in the most expedient time possible." The breach affected more than 8,000 Minnesota patients, and the company and its subsidiary agreed to pay $900,000 across the states.
In the October 5, 2023 Blackbaud settlement, announced with 49 other attorneys general, the office stated that the company discovered a 2020 ransomware breach "by at least May 2020" but did not announce it until July 2020, refused at first to tell customers what data was accessed, and "led its customers to believe that notification was not required." The settlement resolved allegations under consumer protection laws, "breach-notification laws" and HIPAA; Minnesota's share of the $49.5 million was $780,273. Both settlements were multistate, and neither release quotes section 325E.61 by number. No Minnesota-only action citing the section was located for this post. The state's larger multistate data-security recoveries, including Marriott and 23andMe, are listed on the Minnesota state page.
Background
For the underlying law rather than this development: Minnesota privacy law.
Frequently Asked Questions
How many days does a Minnesota business have to send a breach notice?
Does Minnesota's breach law have a risk-of-harm exception?
Do Minnesota state agencies follow section 325E.61?
Are banks covered by the Minnesota breach notification statute?
What must a Minnesota breach notice say?
Sources
Everything above is reported from these documents. Follow them to verify.
- Minn. Stat. § 325E.61, Data warehouses; notice required for certain disclosures (Office of the Revisor of Statutes) statute
- Minn. Stat. § 13.055, Disclosure of breach in security; notification and investigation report required statute
- Minn. Stat. § 8.31, Additional duties of attorney general statute
- Minn. Stat. § 325M.20, Attorney general enforcement (Consumer Data Privacy Act) statute
- Minnesota Attorney General: Settlement in data breach affecting 8,000 Minnesotans (Medical Informatics Engineering) (May 30, 2019) agency release
- Minnesota Attorney General: Blackbaud multistate settlement over 2020 breach (October 5, 2023) agency release
- MCL 445.72, Notice of security breach (Michigan Legislature), for comparison statute
Reporting, not legal advice. This article reports on developments in privacy law using publicly available primary sources, which are linked throughout and listed at the end. It is not legal advice, it is not written or reviewed by an attorney, and it does not assess how any law applies to your situation. Privacy law changes frequently and differs by jurisdiction. Reading this does not create an attorney-client relationship. To find out where you or your business stands, consult a licensed attorney. How we report.