Minnesota Consumer Data Privacy Act
Universal Opt-Out Sensitive and Health Data - Minnesota CDPA

Minnesota Consumer Data Privacy Act MN-CDPA-Universal-Opt-Out-GPC-Sensitive-Data-Section-325O-02-Consumer-Health-Data-Children-Known-Child-Transgender: Minnesota CDPA Universal Opt-Out + GPC + Sensitive + Section 325O.02 + Consumer Health Data + Children + Known Child + Transgender

Recognise Universal Opt-Out Mechanism (Global Privacy Control GPC) mandatory from 31 July 2025 + process sensitive data and consumer health data under enhanced conditions. GPC alignment with Colorado + Connecticut + Texas + California + Delaware + Montana + Nebraska + New Hampshire + New Jersey + Oregon. Sensitive Data Section 325O.02 Subdivision 32: racial or ethnic origin + religious beliefs + mental or physical health diagnosis + sexual orientation + citizenship or immigration status + genetic data + biometric data + precise geolocation data + personal data of known child + transgender or nonbinary status (Minnesota-specific addition during legislative process). Affirmative opt-in consent required for sensitive data processing. Consumer Health Data Section 325O.02 Subdivision 10 SEPARATELY defined category covering mental/physical health + reproductive/sexual health + gender-affirming care + diagnoses + treatments + medications + healthcare service use (similar to Washington My Health My Data + Maryland MODPA). Children under 13 require parental consent (FERPA-style). Minors 13-16 processing requires opt-in. Sale of consumer health data + sensitive data of minors restricted. Minnesota Genetic Information Privacy Act parallel application. Minnesota Health Records Act Chapter 144.291-298 coordination.

What else in your programme already covers this

This control maps to 89 controls across 51 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

ISO 27043 · 4 controls

ISO/SAE 21434 · 4 controls

NIST Post-Quantum Cryptography Standards (FIPS 203, 204, 205) · 4 controls

  • PQC-2 FIPS 203 ML-KEM Implementation - Module-Lattice Key-Encapsulation Mechanism
  • PQC-5 Cryptographic Inventory and PQC Migration Roadmap
  • PQC-7 FIPS Validated Modules, HSM Readiness, and Algorithm Validation
  • PQC-8 Implementation Requirements - RNG, Side-Channel, Key Management, Operations, Incident Response

CISA Cross-Sector Cybersecurity Performance Goals (CPG) 2.0 · 3 controls

ISO/IEC 23837 - Security Requirements for Quantum Key Distribution · 3 controls

NIST SP 800-124 Revision 2 - Guidelines for Managing the Security of Mobile Devices · 3 controls

NIST SP 800-171A Rev 3 - Assessing CUI Security Requirements · 3 controls

AWWA Cybersecurity Guidance for the Water Sector (American Water Works Association) · 2 controls

FBI CJIS Security Policy · 2 controls

  • CJIS-8 Media Protection
  • CJIS-9 System and Communications Protection

ISO 13485 · 2 controls

ISO 15189:2022 - Medical Laboratories Requirements for Quality and Competence · 2 controls

  • 6.6 Confidentiality or non-disclosure agreements
  • 6.7 Conducting Audit Follow-up

ISO 19011 · 2 controls

  • 6.6 Confidentiality or non-disclosure agreements
  • 6.7 Conducting Audit Follow-up

ISO 27799 · 2 controls

ISO 31000:2018 · 2 controls

  • 6.6 Confidentiality or non-disclosure agreements
  • 6.7 Conducting Audit Follow-up

OWASP ASVS · 2 controls

OWASP MASVS · 2 controls

OWASP Top 10:2025 · 2 controls

  • OWASPTOP10-2 A02:2025 Cryptographic Failures and Secret Management
  • OWASPTOP10-4 A04:2025 Insecure Design and Business Logic (incl. A11 API Abuse)

APPI · 1 control

  • APPI-A34 Request for Correction, Addition or Deletion

AS9100D:2016 - Quality Management Systems for Aviation, Space, and Defence · 1 control

  • 9.1 Risk communication and consultation

ASD Strategies to Mitigate Cyber Security Incidents · 1 control

  • ASD37-17 TLS encryption between email servers (Limited)

BSI IT-Grundschutz · 1 control

  • BSI-08 Cryptographic protection of data

Bahrain PDPL · 1 control

FFIEC IT Examination Handbook · 1 control

FIDO2 / WebAuthn · 1 control

FTC GLBA Safeguards Rule (16 CFR Part 314) · 1 control

  • FTC-Safeguards-9-Elements 9 Safeguard Elements - Access, Inventory, Encryption, Secure-Dev, MFA, Disposal, Change-Mgmt, Monitoring, Pen-Test (16 CFR 314.4(c))

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL) · 1 control

  • UAE-PDPL-Art.4_5 Lawful basis and principles for processing personal data (UAE PDPL Articles 4-5)

IEC 62351 - Power Systems Communication Security · 1 control

  • 62351-9 Cyber security key management

ISO 20000-1 · 1 control

  • 9.1 Risk communication and consultation

ISO 22739:2024 - Blockchain and Distributed Ledger Technologies Vocabulary · 1 control

ISO 27005 · 1 control

  • 9.1 Risk communication and consultation

ISO 27017 · 1 control

ISO 27018 · 1 control

ISO/IEC 27010:2015 · 1 control

ISO/IEC 27011:2024 · 1 control

ISO/IEC 27400:2022 · 1 control

ISO/IEC 27557:2022 - Organisational Privacy Risk Management · 1 control

ISO/IEC 29115:2023 - Entity Authentication Assurance Framework · 1 control

MARS-E - Minimum Acceptable Risk Standards for Exchanges · 1 control

MITRE ATT&CK · 1 control

MITRE D3FEND · 1 control

Malaysia PDPA 2010 · 1 control

Mauritius DPA · 1 control

Mexico LFPDPPP · 1 control

Monetary Authority of Singapore Technology Risk Management Guidelines · 1 control

NIST Special Publication 800-34 Revision 1, Contingency Planning Guide for Federal Information Systems · 1 control

  • NISTSP34-3 Preventive Controls and Recovery Strategies: Backup, Alternate Sites, Equipment

OWASP API Security Top 10 - 2023 · 1 control

  • OWASPAPI-6 Security Misconfiguration and Secure API Design

Privacy Act 1988 (Australia) · 1 control

  • AUPRV-4 APP 10-11 Quality, Security of Personal Information

Singapore Government Instruction Manual on ICT&SS Management (IM8) · 1 control

South Korea ISMS-P · 1 control

Switzerland New Federal Act on Data Protection (nFADP/nDSG, 2023) · 1 control

Turkey KVKK · 1 control

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Query this from an agent

The graph holds this control, the 89 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll Minnesota Consumer Data Privacy Act controls