Land of 10,000 Data Lakes: Minnesota Consumer Data Privacy

How uRISQ can help you and your company stay compliant

Starting July 31, 2025, Minnesota will implement a new law called the Minnesota Consumer Data Privacy Act (MCDPA). This law is designed to give Minnesota residents more control over their personal data and sets new expectations for how businesses collect, use, and protect that information.

If your business collects personal information from customers such as names, emails, purchase history, location data, etc.— this law may affect you. Even if you’re a small business, it’s important to understand the law and take reasonable steps toward compliance.

Customers Have New Rights Over Their Data

Minnesota residents now have more control over their personal information. They can:

• Request access to the data your business has collected on them
• Correct inaccurate information
• Ask you to delete their data
• Request a copy of their data to take elsewhere
• Opt-out of targeted advertising, the sale of their data, or decisions made by automated systems that significantly affect them

If someone makes one of these requests, you’re expected to respond within 45 days.

Providing your customers control of their personal information is not just the polite thing to do …. it’s the law.

Be Clear About What You Do With Customer Data

You’ll need to provide a privacy notice that clearly explains:

• What types of customer data you collect
• Why you’re collecting it
• Who you share it with (if anyone)
• How customers can exercise their privacy rights
• Whether you use the data for things like targeted ads or sell it to third parties

This can be something you put on your website or share when someone interacts with your business.

Handle Sensitive Information with Extra Care

Sensitive data includes:

• Health details
• Race or ethnicity
• Religion
• Sexual orientation
• Citizenship status
• Precise location data
• Information on children under 13

You must get explicit opt-in consent before collecting or using this type of data.

Keep Personal Data Secure

Even small businesses are expected to protect customer data. That means:

• Taking steps to prevent unauthorized access
• Keeping only the data you need
• Deleting data when it’s no longer necessary
• Maintaining a basic inventory of what data you collect and store

Avoid Discrimination

You can’t penalize or treat a customer differently just because they’ve exercised their data privacy rights.

Be Transparent About Automated Decisions

If your business uses automated tools or algorithms that make decisions affecting customers—such as credit decisions, pricing, or job application screening—customers have the right to:

• Ask why a decision was made
• Request corrections if the data is inaccurate
• Understand how they could get a different outcome in the future

How uRISQ Can Help

uRISQ was designed with small and medium-sized businesses in mind that are now being asked to do more with data privacy and compliance.

With uRISQ, you can:

• Simplify compliance with the Minnesota Consumer Data Privacy Act
• Automate data privacy tasks like managing customer requests (access, correction, deletion, etc.)
• Secure your customer data with tools and practices that meet reasonable security expectations
• Track and document your data policies so you’re prepared in case of an audit or inquiry
• Stay ahead of regulations with ongoing updates and support, so you don’t have to keep up with every law change on your own

Whether you have a few employees or a hundreds, uRISQ empowers you to build a trustworthy, privacy and security-first business.

Take Action Now

Minnesota’s new law goes into effect July 31, 2025, but preparing now will make the transition smooth—and show your customers that you take their privacy seriously.

Not sure where to start? Let uRISQ help protect your business and your customers’ data.