Minnesota SaaS Agreement Review
Minnesota's Consumer Data Privacy Act, Minn. Stat. 325M.10 and following, took effect July 31, 2025. It goes further than most of its peers, giving consumers a right to question the result of a profiling decision and requiring controllers to keep a data inventory. Minnesota also rewrote its subscription renewal law in 2024. A Minneapolis or St. Paul business buying SaaS should check both.
Consumer privacy law in Minnesota
Minnesota Consumer Data Privacy Act (MCDPA)
Data rights in Minnesota
Minnesota has enacted the Minnesota Consumer Data Privacy Act (MCDPA), a comprehensive consumer privacy law. It gives residents rights over their personal data, typically access, correction, deletion, and the ability to opt out of the sale of data and targeted advertising, and generally requires vendors to sign a data-processing agreement. When you buy SaaS that will hold data about Minnesota residents, the vendor's terms should line up with those obligations.
The clauses that decide your risk
- Data use & AI training, is your data used only to provide the service, or to "improve" (train) the vendor’s models?
- Liability cap, often just one month of fees, against real data-loss exposure
- Auto-renewal, the cancellation-notice window (miss it and you renew for a year)
- Price increases, capped, or unilateral at renewal?
- Data export & deletion on termination, can you get your data out, and is it deleted?
- Uptime SLA and service credits
What is different about Minnesota's privacy law?
The Act applies to businesses that control or process data of 100,000 or more Minnesota consumers a year, or 25,000 or more while earning over 25% of gross revenue from selling data. That revenue test is lower than the 50% used by many states. Postsecondary institutions have until July 31, 2029.
Controllers must maintain an inventory of the data they hold and document their policies. Consumers can question a profiling decision, learn the reasons, and have it reconsidered. If your SaaS vendor scores or ranks people for you, it needs to support those requests.
Minnesota's subscription renewal rules
Minn. Stat. 325G.56 to 325G.62, enacted in 2024, require clear disclosure of terms before a consumer accepts, notice before material changes, a reminder 5 to 30 days before a free trial over 30 days ends, and an annual reminder for continuing services. It protects individual consumers, not business buyers, so a company needs these protections in its contract.
For breaches, Minn. Stat. 325E.61 requires credit bureau notice within 48 hours when more than 500 people are notified at once.
Minnesota breach law details
Minn. Stat. 325E.61 requires notice in the most expedient time possible, and a business that maintains data it does not own must notify the owner immediately after discovery. Personal information is defined narrowly. Financial institutions are outside the statute, and a business following its own security notice procedures with consistent timing is treated as compliant.
Minnesota sources checked 2026-10-09: Minn. Stat. 325M.12 (Revisor of Statutes) · Minn. Stat. 325G.57 (Revisor of Statutes) · Ashurst Perkins Coie, Minnesota breach chart. Laws change; confirm the current rule before relying on it.
Minnesota SaaS agreement FAQ
Does Minnesota have a data privacy law that affects SaaS contracts?
Yes. Minnesota has enacted a comprehensive consumer privacy law, the Minnesota Consumer Data Privacy Act (MCDPA). It gives residents rights over their personal data (such as access, deletion, and opting out of sale or targeted advertising) and generally requires a data-processing agreement, which shapes what a SaaS vendor can do with data about Minnesota residents.
Can a SaaS vendor use my Minnesota business's data to train AI?
Only if the contract lets them. Many SaaS agreements grant the vendor a right to use "customer data" to "improve the services," which can extend to training models. Regardless of Minnesota law, insist the contract says your data is never used to train shared or general-purpose models and is processed only to provide the service to you.
What should I check before signing a SaaS agreement in Minnesota?
The clauses that decide your risk: how your data can be used (and whether it trains AI), the liability cap versus your data-loss exposure, auto-renewal and the cancellation-notice window, unilateral price increases, and whether you can export and require deletion of your data on termination. ClauseAudit flags each against Minnesota law in about a minute.
Does a Minnesota SaaS vendor need to help with the data inventory?
The inventory duty falls on the controller, but a SaaS vendor often holds much of the data. Ask the contract to require the vendor to describe the categories of personal data it processes for you and where it is stored, so you can keep your inventory accurate.
Does Minnesota's renewal law let a business cancel online?
The renewal law covers consumers. For them, a contract accepted online must offer an online way to end it, and other cancellation methods must be as easy as signing up. A business subscriber is outside that definition, so check that the order form lets you cancel by email or portal without a long notice window.
Reviewing a SaaS contract in Minnesota?
Upload it and get the data, liability, and renewal terms checked against Minnesota law in about a minute.
State privacy-law status summarized as of October 2026; this area changes quickly and thresholds and effective dates vary. This is automated educational information, not legal advice, ClauseAudit verifies current Minnesota law when you run your agreement, and you should confirm anything critical with a qualified attorney.