New Mexico Data Breach Notification Law

The New Mexico data breach notification law and its 45-day limit

The Data Breach Notification Act (N.M. Stat. §§ 57-12C-1 to 57-12C-12) starts counting the day a business discovers a breach. Day 45 is the latest the residents' letters can go, and the most expedient time possible may mean earlier ¹. The 2017 act still reads as enacted ³, and a law enforcement request is the one thing that can pause it.

Weekends and holidays count. On discovery day, write the day-45 date at the top of the incident file so every vendor and lawyer works back from it.

One trigger for the Attorney General and the bureaus

Cross the line of more than 1,000 New Mexico residents in a single breach and two outside notices join the resident letters: one to the Office of the Attorney General, one to the major nationwide consumer reporting agencies, both on the same expedient, 45-calendar-day schedule ². The Attorney General's copy states how many residents were notified and attaches the letter itself. Smaller breaches need neither.

Service providers holding records for a client face the same 45-day window and the same harm test when they warn that client ¹.

When the significant-risk test lets you skip letters

No notice is needed if, after an appropriate investigation, the business determines the breach does not give rise to a significant risk of identity theft or fraud ³. Nothing requires putting that finding on paper or sending it to the Attorney General. Do it anyway; a dated memo is how you show the decision was reasoned if a customer or regulator asks later.

Encrypted data is exempt unless the confidential process or key used to decrypt it was also acquired ¹. Biometric data and government-issued ID numbers sit on New Mexico's list beside Social Security, driver's license and account numbers.

Banks, lenders and health care entities already under the Gramm-Leach-Bliley Act or HIPAA fall outside the act and follow those federal rules ¹. For a clinic, that federal timeline is set out in how HIPAA breach notice works.

What a missed New Mexico notice can cost

The Attorney General may sue for an injunction and damages. For knowing or reckless violations, a court may impose a civil penalty of the greater of $25,000 or $10 per failed notice, up to $150,000 ⁴. Customers get no lawsuit of their own; enforcement sits with the Attorney General.

Three standing duties ride along with the notice rule: reasonable security, security clauses in vendor contracts, and safe disposal of personal information ¹. All three fit in one security program document.

Working inside New Mexico's 45 days

Day one, with the attacker possibly still connected: an insured business opens a claim on the carrier's incident line, opens an FBI complaint on ic3.gov, and keeps machines powered and unaltered for the forensic copy ⁵⁶⁷.

From there, a breach response provider or your contracted IT support closes the door, confirms what left the network and tallies people by home state. Next door is mixed: Arizona also allows 45 days, while Texas allows 60 days but wants its Attorney General told at a lower count. The rest are in the all-state notice deadlines chart. Before choosing outside counsel, check the panel rules in cyber policy requirements. Albuquerque businesses can compare local IT support in our Albuquerque managed IT guide.

This page reflects our reading of the act as of October 13, 2026, when we last compared it with the statute. It is a starting point, not legal advice; a New Mexico lawyer can confirm what it means for your business.