Minnesota CDPA

Minnesota Consumer Data Privacy Act - controller duties, consumer rights, sensitive data.


Short name	MN CDPA
Region	Americas
Country or scope	United States
Sector	Privacy
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers MN CDPA

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 8 controls from Safeguard's control catalog for MN CDPA.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 24: 2 written for MN CDPA and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`MN-CDPA-INVENTORY` Statutory Data Inventory	Minnesota uniquely obliges controllers to maintain a data inventory as part of their required data security program; an enumerated inventory of the software components processing consumer data is the direct analogue (Minn. Stat. ch. 325O, controller data-inventory duty)	Scan
`MN-CDPA-INVQUALITY` Inventory Completeness	A data inventory only serves its statutory purpose if entries are usable: each inventoried component should carry both a name and a version so the inventory supports security and rights obligations (Minn. Stat. ch. 325O, data-inventory and documentation duties)	Scan
`MN-CDPA-SEC` Data Security Practices	Controllers must establish, implement and maintain reasonable administrative, technical and physical data security practices appropriate to the volume and nature of the personal data; integrity-verifiable processing software evidences that program (Minn. Stat. ch. 325O, controller-duties provision)	Scan
`MN-CDPA-PROC` Processor Obligations	Processors act under binding contracts with controller instructions and flow-down duties to subcontractors; named suppliers on third-party components demonstrate the required oversight (Minn. Stat. ch. 325O, processor provisions)	Scan
`MN-CDPA-DPIA` Privacy and Security Assessment Readiness	Data privacy and protection assessments are required for heightened-risk processing including profiling, targeted advertising, sale and sensitive data; recorded software versions underpin credible assessment (Minn. Stat. ch. 325O, assessment provisions)	Scan
`MN-CDPA-PROFILING` Profiling Contestability Readiness	Consumers may question the result of profiling used in furtherance of significant decisions and learn what actions they could have taken for a different outcome; explaining a system's decisions requires its constituent components to be unambiguously identified (Minn. Stat. ch. 325O, profiling-rights provisions)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`MN-325O.04`	Consumer Rights: Access, Correction, Deletion & Portability
`MN-325O.05`	Opt-Out of Sale, Targeted Advertising & Profiling
`MN-325O.06`	Sensitive Data Consent
`MN-325O.08`	Data Protection Assessment
`MN-325O.09`	Processor Agreements
`MN-325O.03`	Privacy Notice Requirements
`MN-325O.07`	Universal Opt-Out Mechanism
`MN-325O.10`	Consumer Appeals & Non-Discrimination

Policy templates

Written for MN CDPA:

Minnesota CDPA State Privacy Notice
Minnesota CDPA Consumer Rights Request Handling Procedure

And 22 from the standard set, adapted to MN CDPA.