Data breach notification
Minnesota's breach notice section is Minn. Stat. § 325E.61.
Two features stand out: there is no risk-of-harm exception, and a separate 48-hour clock applies to the credit bureaus for larger incidents.
A business must disclose a breach to any Minnesota resident whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure must be made in the most expedient time possible and without unreasonable delay.
No risk-of-harm exception appears in § 325E.61. If covered data was acquired, the duty to tell residents does not turn on a business's view of how likely misuse is.
Personal information is a first name or first initial and last name together with a Social Security number, a driver's license or Minnesota identification card number, or an account number or credit or debit card number.
An element counts when it is not secured by encryption or another method that makes it unreadable or unusable, or when it was secured but the key, password or other means of reading it was also acquired.
| Step | Minnesota rule |
|---|---|
| State regulator notice | None appears in § 325E.61 |
| Consumer reporting agencies | Notified within 48 hours when more than 500 persons are told at one time |
The 48-hour clock for the bureaus is far tighter than the open-ended rule for residents, so a business notifying more than 500 people at once should plan both steps together rather than treat the bureau notice as an afterthought.
After an incident, the first question is simply whose information was exposed.
For documents you share through ShareAndGo, the activity log records every view and download, and watermarked view-only pages carry the reader's email address and the date.
That watermark is a per-room setting, switched on from the start. Recipients confirm their email with a six-digit code and need no account, which keeps every log entry tied to a real address. Export the chained log as CSV whenever you need it.
Checked against Minnesota's published law on November 2, 2026. This is general information, not legal advice.
