Compliance FrameworksAmericas
Minnesota CDPA
Minnesota Consumer Data Privacy Act - controller duties, consumer rights, sensitive data.
Minnesota Consumer Data Privacy Act - controller duties, consumer rights, sensitive data.
| Short name | MN CDPA |
| Region | Americas |
| Country or scope | United States |
| Sector | Privacy |
| In your workspace | On unless you switch it off in Compliance › Manage. |
How Safeguard covers MN CDPA
- Scan requirements: 6, all decided by a scan.
- Controls: the scan requirements below, plus 8 controls from Safeguard's control catalog for MN CDPA.
- Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
- Policy templates: 24: 2 written for MN CDPA and 22 from the standard set.
How each kind of coverage works, and what the readiness score counts: Compliance frameworks.
What a scan checks
Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).
| Requirement | What Safeguard checks | Decided by |
|---|---|---|
MN-CDPA-INVENTORY Statutory Data Inventory | Minnesota uniquely obliges controllers to maintain a data inventory as part of their required data security program; an enumerated inventory of the software components processing consumer data is the direct analogue (Minn. Stat. ch. 325O, controller data-inventory duty) | Scan |
MN-CDPA-INVQUALITY Inventory Completeness | A data inventory only serves its statutory purpose if entries are usable: each inventoried component should carry both a name and a version so the inventory supports security and rights obligations (Minn. Stat. ch. 325O, data-inventory and documentation duties) | Scan |
MN-CDPA-SEC Data Security Practices | Controllers must establish, implement and maintain reasonable administrative, technical and physical data security practices appropriate to the volume and nature of the personal data; integrity-verifiable processing software evidences that program (Minn. Stat. ch. 325O, controller-duties provision) | Scan |
MN-CDPA-PROC Processor Obligations | Processors act under binding contracts with controller instructions and flow-down duties to subcontractors; named suppliers on third-party components demonstrate the required oversight (Minn. Stat. ch. 325O, processor provisions) | Scan |
MN-CDPA-DPIA Privacy and Security Assessment Readiness | Data privacy and protection assessments are required for heightened-risk processing including profiling, targeted advertising, sale and sensitive data; recorded software versions underpin credible assessment (Minn. Stat. ch. 325O, assessment provisions) | Scan |
MN-CDPA-PROFILING Profiling Contestability Readiness | Consumers may question the result of profiling used in furtherance of significant decisions and learn what actions they could have taken for a different outcome; explaining a system's decisions requires its constituent components to be unambiguously identified (Minn. Stat. ch. 325O, profiling-rights provisions) | Scan |
More controls in the catalog
The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.
| Control | Name |
|---|---|
MN-325O.04 | Consumer Rights: Access, Correction, Deletion & Portability |
MN-325O.05 | Opt-Out of Sale, Targeted Advertising & Profiling |
MN-325O.06 | Sensitive Data Consent |
MN-325O.08 | Data Protection Assessment |
MN-325O.09 | Processor Agreements |
MN-325O.03 | Privacy Notice Requirements |
MN-325O.07 | Universal Opt-Out Mechanism |
MN-325O.10 | Consumer Appeals & Non-Discrimination |
Policy templates
Written for MN CDPA:
- Minnesota CDPA State Privacy Notice
- Minnesota CDPA Consumer Rights Request Handling Procedure
And 22 from the standard set, adapted to MN CDPA.