What a Minnesota business has to have in writing
Minnesota is one of the few states that legislates the employee handbook itself: the Department of Labor and Industry publishes a running list of notices that must appear in a handbook if the employer keeps one, covering sick and safe time, pregnancy accommodation, nursing mothers and more.
MNOSHA adds a written AWAIR accident and injury reduction program for designated high-hazard industries and a joint safety committee at 25 employees, both Minnesota-only.
The Minnesota Consumer Data Privacy Act took effect in July 2025 with a distinctive documented data inventory duty, insurers certify an information security program to Commerce each April, and salary ranges have been mandatory in job postings since January 2025.
Minnesota has a rule of its own in 13 of the 14 areas, listed below. In 1 more we searched the state's own site and found nothing beyond the federal rule, but we have not finished writing up where we looked, so that one is not shown yet.
Headcount
Industry General is always on
Share
Ad from the publisher
Policy Acknowledgment Proof
MinnesotaHandbook 2026acknowledged by name
Minnesota on Recordwith AllyMatter
Cover Minnesota the Modern WayEvery policy Minnesota makes you write, acknowledged by name
01
Approve it, lock the version
Non-author approval, obsolete copies blocked
02
Every employee in Minnesota on record
Who read which version, and when
03
Walk into any state inspection with the trail
From $29/mo, 20 editors, unlimited staff (published)
Minnesota rules for a 15–19 person general business
We check the same 14 areas of state law on every state page: breach notification, data security program, consumer privacy law, biometric and health data, harassment prevention, workplace safety programs, workplace violence prevention, insurance data security, state vendor security program, paid leave policies, required postings, pay transparency, licensing and certifications, and other written policies. Federal rules apply in most of these already. What this page adds is whether Minnesota has a rule of its own on top. The federal rules every employer carries follow the Minnesota rules. Each row names what you must write, post, file or certify, who enforces it, and links to the authority.
Breach Notification 1Who you must tell after a data breach, and how fast
LawProduceWhat it requiresTriggerEnforced by
Data breach notificationMinn. Stat. § 325E.61 #Any person or business that conducts business in Minnesota and owns or licenses computerized personal information about Minnesota residentsDistribute
Notice
Notify affected Minnesota residents in the most expedient time possible and without unreasonable delay once an unauthorized acquisition of unencrypted personal data is discovered. If more than 500 residents must be told at once, also notify the national consumer reporting agencies within 48 hours. Notice must be given to the data owner within 48 hours if the breach happened at a vendor holding someone else's data.
From the first employee
Minnesota Attorney General
Data Security Program 1A written safeguards program the state requires before anything goes wrong
LawProduceWhat it requiresTriggerEnforced by
Plastic Card Security ActMinn. Stat. § 325E.64 #Any person or business conducting business in Minnesota that accepts payment cardsWrite
Written program
Do not retain card security code, PIN verification code or full magnetic stripe data for more than 48 hours after a transaction is authorized, and delete it from all systems and records after that. A business that keeps the data and then suffers a breach must reimburse the financial institutions for the cost of blocking and reissuing cards and related losses.
From the first employee
Private civil action by financial institutions; Minnesota Attorney General
Consumer Privacy Law 1Rights, notices and assessments for consumer data
LawProduceWhat it requiresTriggerEnforced by
Minnesota Consumer Data Privacy ActMinn. Stat. ch. 325M #Businesses operating in Minnesota or targeting Minnesotans that in a year handled personal data of 100,000+ consumers, or of 25,000+ consumers while earning more than 25 percent of gross revenue from selling personal data; small businesses as defined by the SBA are largely exemptWrite
Written policy
Publish a privacy notice covering categories, purposes, sharing, retention, rights and appeals; maintain and document a data inventory; keep written data privacy and security policies plus data protection assessments for targeted advertising, sales, profiling and sensitive data; get opt-in consent for sensitive data; and honor access, correction, deletion, portability, profiling-review and opt-out requests including universal opt-out signals.
From the first employee
Minnesota Attorney General (exclusive)
Biometric and Health Data 1Consent and retention rules for fingerprints, faces and health data
LawProduceWhat it requiresTriggerEnforced by
Biometric data as sensitive data under the Minnesota Consumer Data Privacy ActMinn. Stat. §§ 325M.11(d), 325M.11(v), 325M.14, 325M.16(d), 325M.17 #Minnesota has no standalone biometric statute of the Illinois BIPA type. Biometric data is regulated as sensitive data inside the Consumer Data Privacy Act, which reaches controllers handling personal data of 100,000 or more consumers, or 25,000 or more while earning over a quarter of gross revenue from selling personal data. Separately, § 325M.17 bars any SBA-defined small business doing business in Minnesota from selling sensitive data without prior consent, so the smallest employers are not fully outside itWrite
Written policy
Biometric data means data from automatic measurement of biological characteristics, including fingerprints, voiceprints, retinas and irises, used to identify a person. Processing it to uniquely identify someone makes it sensitive data, so get the consumer's opt-in consent before processing, name it in the privacy notice, and keep it inside the documented data inventory and data security practices the Act requires. A consumer asking what a controller holds must be told, with particularity, whether biometric data is among it. Small businesses must not sell sensitive data without prior consent.
From the first employee
Minnesota Attorney General
AuthorityMinnesota Office of the Revisor of Statutes - § 325M.11 (definitions of biometric data and sensitive data)Minnesota Office of the Revisor of Statutes - § 325M.16 (consent required to process sensitive data)Minnesota Office of the Revisor of Statutes - § 325M.17 (small business ban on selling sensitive data)Minnesota Office of the Revisor of Statutes - § 325M.14 (consumer rights, disclosure of biometric data held)Report an error
Workplace Safety Programs 2Written programs the state safety agency requires beyond federal OSHA
LawProduceWhat it requiresTriggerEnforced by
AWAIR - A Workplace Accident and Injury Reduction programMinn. Stat. § 182.653 subd. 8 #Employers in the industries the Department of Labor and Industry designates as having high injury rates, listed by SIC/NAICS codeWrite
Written program
Write and maintain an AWAIR program that states how managers, supervisors and employees are responsible for safety, how hazards are identified, analyzed and controlled, how the workplace and standards are communicated to employees, how accidents are investigated, and how the program is enforced and reviewed. The written program has to be available to employees and to MNOSHA on request.
From the first employee
Minnesota Department of Labor and Industry, MNOSHA
MNOSHA State Plan and joint safety committee requirementMinn. Stat. ch. 182; Minn. Stat. § 182.676; 29 CFR 1952 (Minnesota State Plan) #All private-sector and public employers in Minnesota; the safety committee duty applies at 25 or more employees, or below that where the injury rate exceeds the state averageWrite
Written program
Follow the MNOSHA standards, which include Minnesota-only rules on top of the federal set, display the MNOSHA poster, keep injury and illness records and report fatalities and serious injuries. Employers at or above the threshold must run a joint labor-management safety committee that meets regularly, keeps minutes, and gives employees a route to raise hazards.
25+ employees
Minnesota Department of Labor and Industry, MNOSHA Compliance
State Vendor Security Program 1Certification a vendor needs before selling cloud services to the state
LawProduceWhat it requiresTriggerEnforced by
GovRAMP authorization requirement for state cloud vendorsMinnesota IT Services GovRAMP program, announced July 11, 2025 #Cloud service providers under State of Minnesota contracts that handle data the state classifies as high-categorizedCertify
Certification
Get the product GovRAMP Authorized. New state contracts for cloud vendors handling high-categorized data already carry GovRAMP language, and existing contracts pick it up at the next amendment or renewal; by April 1, 2027 every such vendor, new or existing, must hold the authorization. A FedRAMP authorization is accepted in its place, but the vendor still has to enroll in GovRAMP continuous monitoring, which means keeping the security package and evidence current rather than certifying once.
From the first employee
Minnesota IT Services, Office of the State Chief Information Security Officer
Paid Leave Policies 2Sick and family leave laws that come with a written policy or notice
LawProduceWhat it requiresTriggerEnforced by
Earned Sick and Safe Time (ESST)Minn. Stat. §§ 181.9445 to 181.9448 #Every employer with at least one employee working in MinnesotaWrite + ack
Written policy
Accrue at least one hour of paid sick and safe time for every 30 hours worked, up to 48 hours a year, with carryover to 80 hours, or frontload instead. Give every employee written notice of ESST rights in English and, on request, their primary language by their start date, include ESST in the employee handbook if the employer keeps one, show accrued and used balances at the end of each pay period, and post the state ESST notice.
From the first employee
Minnesota Department of Labor and Industry, Labor Standards
Minnesota Paid LeaveMinn. Stat. ch. 268B #Nearly every Minnesota employer; benefits opened January 1, 2026 and small employers get a reduced premium rateDistribute + ack
Notice
Post the state Paid Leave notice at each worksite and give every employee written notice of Paid Leave benefits, premium deductions, job protection and anti-retaliation, in English and, where applicable, the employee's primary language. Employers submit quarterly wage detail and premiums or run an approved private plan, and keep the supporting records.
From the first employee
Minnesota Department of Employment and Economic Development, Paid Leave Division
Required Postings 1The notices every workplace in the state must display
LawProduceWhat it requiresTriggerEnforced by
Required workplace postersMinn. Stat. §§ 177.31, 181.9447, 181.939, 182.66, 268B; Minn. Stat. ch. 176 (workers' compensation) #Every Minnesota employerPost
Posting
Display the Department of Labor and Industry poster pack where employees can read it: minimum wage, age discrimination, safety and health protection (MNOSHA), earned sick and safe time, employee right to review personnel record, unemployment insurance, workers' compensation and Paid Leave. The state publishes the pack free in English, Hmong, Somali and Spanish.
From the first employee
Minnesota Department of Labor and Industry
Pay Transparency 1Salary ranges in job posts and pay disclosure on request
LawProduceWhat it requiresTriggerEnforced by
Salary range disclosure in job postingsMinn. Stat. § 181.173 #Employers with 30 or more employees at one or more sites in MinnesotaDistribute
Notice
Include a good-faith starting salary range, with a fixed minimum and maximum rather than an open-ended figure, and a general description of benefits and other compensation in every job posting, whether the employer posts it directly or through a third party. If the position pays a fixed amount, say so.
30+ employees
Minnesota Department of Labor and Industry
Licensing and Certifications 1Registrations, licenses and certifications a business or its staff must hold
LawProduceWhat it requiresTriggerEnforced by
Business registration (Secretary of State Business Services)Minn. Stat. ch. 302A (corporations); ch. 322C (LLCs); ch. 333 (assumed names) #Any corporation, LLC, limited partnership, nonprofit or out-of-state entity doing business in Minnesota; sole proprietors trading under another name file an assumed nameFile
Filing / record
File formation or foreign-registration documents with the Secretary of State, keep a registered agent and office on record, and file the annual renewal each year to stay active. Assumed names also need published notice in a qualified legal newspaper.
From the first employee
Minnesota Secretary of State, Business Services
Other Written Policies 3Any other document the state makes an employer write or hand out
LawProduceWhat it requiresTriggerEnforced by
Employee notices and handbook inclusion requirementsMinn. Stat. §§ 181.032, 181.939, 181.9414, 181.9447 and related notice provisions #Every Minnesota employer; some items apply only where the employer maintains a handbookDistribute + ack
Notice
Give each employee a written wage notice at the start of employment stating pay rate and basis, allowances, paid time off accrual, employment status, deductions, pay day, the employer's legal name and address, and a phone number, and have the employee sign it. Where the employer keeps a handbook, several state notices must appear in it, including earned sick and safe time, pregnancy accommodation and nursing mothers, and updated notices must be reissued in writing whenever the terms change.
From the first employee
Minnesota Department of Labor and Industry, Labor Standards
Drug and Alcohol Testing in the Workplace Act (written testing policy)Minn. Stat. §§ 181.950 to 181.957, policy duty at § 181.951 and § 181.952 #Any Minnesota employer that tests employees or applicants for drugs, alcohol or cannabisWrite
Written policy
Adopt a written drug and alcohol testing policy before testing anyone, covering who may be tested and on what basis, which substances are screened, the rights to a confirmatory retest and to explain a positive result, confidentiality, and the consequences. Give the policy to every affected employee, post a notice that the policy is in effect, and use a licensed testing laboratory.
From the first employee
Minnesota Department of Labor and Industry; private civil action
Noncompete agreement banMinn. Stat. § 181.988 #Every Minnesota employer, for agreements entered into on or after July 1, 2023Write
Written policy
Stop using employee and independent contractor noncompete clauses, which are void and unenforceable in Minnesota regardless of pay level, and remove out-of-state choice-of-law or venue clauses aimed at getting around the ban. Nondisclosure, non-solicitation and sale-of-business restrictions remain available and should be documented separately.
From the first employee
Minnesota courts; Attorney General
Because You Are in Construction 1Industry layer
LawProduceWhat it requiresTriggerEnforced by
Residential building contractor and remodeler licenseMinn. Stat. ch. 326B #Anyone contracting directly with a homeowner for two or more special skills of residential construction, remodeling or roofing in MinnesotaFile
Filing / record
Hold a residential building contractor, remodeler or roofer license from the Department of Labor and Industry before contracting, name a qualifying person who completes the required continuing education, carry the required insurance and bond, pay the Contractor Recovery Fund assessment, renew annually, and use a written contract that carries the license number and the statutory consumer disclosures.
From the first employee
Minnesota Department of Labor and Industry, Construction Codes and Licensing
Because You Are in Healthcare 1Industry layer
LawProduceWhat it requiresTriggerEnforced by
Hospital violence prevention planMinn. Stat. § 144.566 #Hospitals licensed in MinnesotaWrite
Written program
Write and keep current a violence prevention plan built from an annual risk assessment of each unit, covering staffing, physical layout, security, de-escalation and response procedures, incident reporting and post-incident support. Train affected workers each year, track and report incidents, and review the plan with the hospital's violence prevention committee. MNOSHA also publishes workplace violence prevention guidance for other employers.
From the first employee
Minnesota Department of Health (hospital licensing); MNOSHA
Because You Are in Food & Beverage 1Industry layer
LawProduceWhat it requiresTriggerEnforced by
Food, pool and lodging establishment licenseMinn. Stat. ch. 157; Minn. R. ch. 4626 (Minnesota Food Code) #Restaurants, caterers, food carts, mobile units, lodging and other food establishments in MinnesotaFile
Filing / record
Get a license from the Department of Health or the delegated county before opening and renew it annually, keep a certified food protection manager on staff, have food handlers trained, and maintain the written procedures the Food Code requires, including an employee health reporting agreement and a HACCP plan or variance for specialized processes.
From the first employee
Minnesota Department of Health, Food, Pools and Lodging Services; delegated local health departments
Because You Are in Financial & Tax 1Industry layer
LawProduceWhat it requiresTriggerEnforced by
Insurance information security programMinn. Stat. § 60A.9851 #Insurers, agents and other entities licensed by the Department of Commerce; smaller licensees below the statutory employee and revenue thresholds are exempt from the program dutyCertify
Certification
Build a written information security program from a documented risk assessment, with administrative, technical and physical safeguards, board or senior management oversight, third-party service provider due diligence and a written incident response plan. File the annual compliance report with the Commissioner of Commerce by April 15, and notify the Department of a cybersecurity event within five business days of determining one occurred.
25+ employees
Minnesota Department of Commerce
Federal rules for a 15–19 person general business
Federal rules apply in every state, on top of the Minnesota rules above. Minnesota has an OSHA-approved State Plan covering private sector workers, so the state program enforces the workplace safety rows here and must be at least as effective as OSHA. OSHA State Plans ↗
From the publisher
Keep Your Written Policies in One Place
Whatever you are working toward, AllyMatter gets your policies approved, keeps every version and records who has read each one.
See how AllyMatter works ↗From $29/mo, 20 editors, unlimited staff
Your business type, with Minnesota on top
Small businessFederal + industry, with Minnesota on topConstruction contractorsFederal + industry, with Minnesota on topHealthcare practicesFederal + industry, with Minnesota on topFood and beverage businessesFederal + industry, with Minnesota on topTax and accounting firmsFederal + industry, with Minnesota on topRegistered investment advisersFederal + industry, with Minnesota on topInsurance agenciesFederal + industry, with Minnesota on topRetail and e-commerceFederal + industry, with Minnesota on topTrucking and logistics carriersFederal + industry, with Minnesota on topNonprofitsFederal + industry, with Minnesota on topFederal contractorsFederal + industry, with Minnesota on top
For another state
Alabama12Alaska12Arizona11Arkansas14California24Colorado18Connecticut17Delaware17District of Columbia12Florida15Georgia13Hawaii16Idaho13Illinois19Indiana16Iowa13Kansas11Kentucky14Louisiana13Maine15Maryland19Massachusetts16Michigan15Mississippi11Missouri12Montana15Nebraska13Nevada18New Hampshire13New Jersey19New Mexico13New York17North Carolina12North Dakota13Ohio13Oklahoma11Oregon19Pennsylvania12Rhode Island13South Carolina12South Dakota11Tennessee14Texas15Utah13Vermont17Virginia17Washington21West Virginia14Wisconsin15Wyoming13
Need a hand implementing it?
Find a Consultant Who Does This Work
Tell us what you need done and we will point you to firms that do this work. Your details go to a firm only when you choose it.
Sources
Minnesota Revisor - Minn. Stat. § 325E.61Minnesota Attorney GeneralMinnesota Revisor - Minn. Stat. ch. 325MMinnesota Revisor - Minn. Stat. § 325E.64Minnesota DLI - AWAIR programMinnesota Revisor - Minn. Stat. § 182.653Minnesota DLI - Differences between state and federal OSHAMinnesota DLI - MNOSHA ComplianceMinnesota Revisor - Minn. Stat. § 182.676OSHA - Minnesota State PlanMinnesota Revisor - Minn. Stat. § 144.566Minnesota DLI - MNOSHA workplace violence preventionMinnesota Revisor - Minn. Stat. § 181.173Minnesota DLI - Employee notices and handbook requirementsMinnesota DLI - Earned sick and safe timeMinnesota Revisor - Minn. Stat. § 181.9445Minnesota DLI - Workplace postersMinnesota DEED - Paid LeaveMinnesota Revisor - Minn. Stat. ch. 268BMinnesota Revisor - Minn. Stat. § 181.032Minnesota Revisor - Minn. Stat. § 181.939Minnesota Revisor - Minn. Stat. § 181.951Minnesota Revisor - Minn. Stat. § 181.988Minnesota Department of Commerce - Information SecurityMinnesota Revisor - Minn. Stat. § 60A.9851Minnesota Secretary of State - Business and LiensMinnesota DLI - Residential contractors, remodelers, roofersMinnesota Department of Health - Food business licensingMinnesota Department of Health - Food safetyMinnesota Office of the Revisor of Statutes - § 325M.11 (definitions of biometric data and sensitive data)Minnesota Office of the Revisor of Statutes - § 325M.16 (consent required to process sensitive data)Minnesota Office of the Revisor of Statutes - § 325M.17 (small business ban on selling sensitive data)Minnesota Office of the Revisor of Statutes - § 325M.14 (consumer rights, disclosure of biometric data held)Minnesota IT Services - Minnesota enhances cybersecurity defenses through GovRAMP partnershipMinnesota IT Services - For VendorsMinnesota Legislative Commission on Cybersecurity - MNIT update, October 27, 2025