New Mexico Data Breach Notification Act

· About New Mexico Data Breach Notification Act

Key Takeaways

  • The New Mexico Data Breach Notification Act applies to any person that owns or licenses computerized data including New Mexico residents’ personal identifying information, and it requires resident notice when that information is reasonably believed to have been subject to a security breach.[12]
  • Covered entities must notify affected New Mexico residents within 45 calendar days of discovery of the breach, unless an exception applies or the notice is delayed for law-enforcement or remediation reasons.[12]
  • If a breach affects more than 1,000 New Mexico residents, the notifying party must also send notice to the New Mexico Attorney General and the nationwide consumer reporting agencies.[12]
  • The statute requires reasonable security procedures and practices to protect personal identifying information, including for service providers handling the data on another party’s behalf.[6][12]
  • The Attorney General may seek injunctive relief and civil penalties, and a knowing or reckless violation can trigger the greater of $25,000 or $10 per failed notification, capped at $150,000 for failed-notice cases.[8]
  • No 2025–2026 amendment or delay appears in the official materials reviewed here; the statute remains the 2017 law as codified in Chapter 57, Article 12C.[3][4][12]

What It Is

The New Mexico Data Breach Notification Act is the state’s general breach-notification law, codified in NMSA 1978, Chapter 57, Article 12C, and it governs notice after a breach involving personal identifying information of New Mexico residents.[3][4][12] The statute was enacted in 2017, signed as House Bill 15 on 6 April 2017, and its operative sections provide a 45-day notification rule and Attorney General reporting requirements for larger incidents.[12] The available codified text and secondary state-law references reviewed here show the law in force through 2026, with no identified 2025 or 2026 amendment, postponement, or sunset.[1][3][4]

The law is enforced by the New Mexico Attorney General, who may bring civil actions for violations.[8][12] The statute also includes a delayed-notification provision when notice would interfere with law-enforcement needs or the ability to assess and contain the incident.[11][12]

Who Must Comply

The law applies to a person that owns or licenses computerized data including personal identifying information of a New Mexico resident.[12] It also reaches service-provider relationships: a person licensed to maintain or possess the data must notify the owner or licensee when a breach occurs at the service-provider level.[6][12]

The statute has an explicit government exemption for the state and its political subdivisions, which were excluded from the Act when enacted.[2] Nothing in the statutory text reviewed suggests a general small-business exemption, nonprofit exemption, or sector-specific carve-out; applicability turns on whether the entity owns or licenses covered data.[12]

The law has extraterritorial effect in practice because it protects New Mexico residents, regardless of where the covered entity is located.[12] The AG notice duty is triggered only when the breach requires notice to more than 1,000 New Mexico residents.[12]

Core Requirements

  1. Provide resident notice promptly: Notify each affected New Mexico resident in the most expedient time possible, but no later than 45 calendar days after discovery of the security breach, unless delay is justified under the statute.[12]
  2. Assess whether notice is required: If, after an appropriate investigation, the entity determines the breach does not create a significant risk of identity theft or fraud, resident notice is not required under the Act.[12]
  3. Include required notice content: Resident notices must identify the notifier, describe the types of personal identifying information involved, give the breach date or estimated range if known, describe the incident, and provide credit-reporting agency contact information and other statutory consumer guidance.[7][12]
  4. Notify the Attorney General and credit bureaus for large breaches: When more than 1,000 New Mexico residents must be notified, send notice to the Attorney General and nationwide consumer reporting agencies within the statutory period.[12]
  5. Maintain reasonable security: Entities must implement reasonable security procedures and practices appropriate to the nature of the information, and service providers must do likewise for covered data in their possession.[5][6][12]
  6. Use delayed notice only when permitted: Notice may be delayed where needed to comply with law-enforcement needs or to determine the breach’s scope and restore the system’s integrity, security, and confidentiality.[11][12]

Deadlines and Penalties

| milestone | date | what applies | |---|---:|---| | Law enacted | 6 April 2017 | House Bill 15 was signed into law and created the Data Breach Notification Act.[12] | | Resident notice deadline | 45 calendar days after discovery | Notice to affected New Mexico residents is due unless a statutory exception or delay applies.[12] | | AG / credit bureau notice trigger | Same 45-day period | Applies when notice must be sent to more than 1,000 New Mexico residents.[12] | | Delayed-notice window | As long as necessary | Notice may be delayed for law-enforcement or investigation/containment reasons.[11][12] |

The Attorney General may seek injunctive relief and civil penalties for violations.[8][12] For a knowing or reckless violation, the court may impose the greater of $25,000 or $10 per failed notification, up to a maximum of $150,000 for failed-notification cases.[8] The statutory materials reviewed also describe other remedies tied to actual losses and court orders, so incident response should assume both regulatory and civil exposure.[14]

How to Comply

  1. Map resident data and owners: Identify where New Mexico residents’ personal identifying information sits, who owns or licenses it, and which vendors or service providers can trigger third-party notice duties.[5][6][12]
  2. Adopt a breach response playbook: Build a documented incident-response process aligned to NIST CSF 2.0 for detection, containment, recovery, and communications, with a notification decision tree keyed to the Act’s 45-day deadline.[12]
  3. Tighten baseline controls: Use ISO 27001-style controls for access management, logging, encryption, vendor oversight, and risk treatment so the “reasonable security procedures” requirement is operational rather than aspirational.[5][12]
  4. Operationalize AI and privacy governance where relevant: Where organizations use automated classification or response tooling, ISO 42001-style governance can support accountable decision-making, human oversight, and documented risk controls, but it does not replace the statutory notice analysis.[12]
  5. Create notification templates now: Pre-draft resident, Attorney General, and credit bureau notices that include the statute’s required fields so legal, privacy, and communications teams can issue compliant notices quickly.[7][12]
  6. Test the 45-day clock: Run breach simulations that start the clock at discovery, not at containment, and verify escalation paths for multi-state events and large breaches affecting more than 1,000 New Mexico residents.[12]
  7. Track vendor contracts: Require service providers to notify the covered business promptly, cooperate in investigations, and maintain equivalent security obligations in data-processing agreements.[5][6][12]

Related Regulations

The New Mexico Unfair Practices Act can overlap where a breach response or privacy misstatement becomes consumer deception, but it is not the core breach-notification rule.[1][8] The federal FTC Act and the FTC’s data-security enforcement theory can overlap with the state’s “reasonable security” duty for non-sector-specific businesses.[5][12] The HIPAA Breach Notification Rule may apply in parallel for protected health information, creating separate timing and content duties for covered entities and business associates. The GLBA Safeguards Rule can overlap for financial institutions, especially on security controls and incident response, even though it is not a substitute for New Mexico resident notice.[5][12] The Colorado Privacy Act and similar state privacy laws may add cross-border governance duties, but they do not displace New Mexico’s specific breach-notification timeline for New Mexico residents.[12]

FAQ

Does the law apply to companies outside New Mexico?

Yes. The trigger is whether the breached data includes personal identifying information of a New Mexico resident, not whether the business is physically located in New Mexico.[12] That means an out-of-state processor or cloud provider can create New Mexico notice obligations if its incident affects New Mexico residents’ data.[6][12]

Is notice always required after a breach?

No. After an appropriate investigation, if the entity determines the incident does not create a significant risk of identity theft or fraud, the statute does not require resident notice.[12] Even then, organizations should document the risk analysis because the Attorney General can later scrutinize the decision.[8][12]

When is the deadline to notify residents?

The statute requires notice in the most expedient time possible, but no later than 45 calendar days after discovery of the breach, subject to the law’s delay provisions.[12] That clock starts when the breach is discovered, not when the investigation is completed.[12]

Does a breach affecting fewer than 1,000 residents still require state notice?

Usually, the Attorney General and credit bureau notice requirement is tied to breaches requiring notice to more than 1,000 New Mexico residents.[12] Even below that threshold, resident notice can still be mandatory under the Act if the data and risk criteria are met.[12]

What happens if a company ignores the law?

The Attorney General can seek court enforcement, including injunctions, and the court may impose civil penalties.[8][12] For knowing or reckless violations, the statute authorizes the greater of $25,000 or $10 per failed notification, up to $150,000 in the failed-notification context.[8]

Does the law cover security procedures, not just breach notices?

Yes. The Act includes a requirement to implement reasonable security procedures and practices to protect personal identifying information.[5][12] That means compliance is both preventive and reactive: organizations need ongoing controls, not only a breach letter template.

Sources

Put it into practice

More compliance guides