Minn. Stat. § 46A.02: SAFEGUARDING CUSTOMER INFORMATION; STANDARDS.

Subdivision 1. Information security program.

(a) A financial institution must develop, implement, and maintain a comprehensive information security program.

(b) The information security program must: (1) be written in one or more readily accessible parts; and (2) contain administrative, technical, and physical safeguards that are appropriate to the financial institution's size and complexity, the nature and scope of the financial institution's activities, and the sensitivity of any customer information at issue.

(c) The information security program must include the elements set forth in section 46A.03 and must be reasonably designed to achieve the objectives of this chapter, as established under subdivision 2.

Subd. 2. Objectives.

The objectives of this chapter are to:

(1) ensure the security and confidentiality of customer information;

(2) protect against any anticipated threats or hazards to the security or integrity of customer information; and

(3) protect against unauthorized access to or use of customer information that might result in substantial harm or inconvenience to a customer.