Conduct Data Privacy Assessment (DPIA) under Section 325O.07 for high-risk processing activities. MANDATORY DPIA triggers: (a) processing of sensitive data; (b) processing for purposes of targeted advertising; (c) sale of personal data; (d) processing for profiling presenting reasonably foreseeable risk of (i) unfair or deceptive treatment of or unlawful disparate impact on consumers + (ii) financial physical or reputational injury + (iii) physical or other intrusion upon solitude or seclusion or private affairs + (iv) other substantial injury to consumers; (e) processing of consumer health data; (f) other processing presenting heightened risk of harm including AI/ML training (Minnesota-explicit). DPIA contents: (a) categories of personal data + processing purposes + necessity assessment + benefit-vs-risk analysis; (b) risks to consumers; (c) safeguards employed; (d) data flows + sharing arrangements; (e) retention periods. DPIA available to Minnesota Attorney General upon investigation request. Single DPIA may cover comparable processing activities. Annual review required. DPIA records retained for 5 years. Privacy by design integrated. Algorithm impact assessment for AI/ML processing including bias testing + explainability + accuracy metrics + human oversight + appeal pathway.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.