Data Breach Notice to Residents and State Authorities in New Mexico
At a glance
| Covered entity and service provider | Owner/licensee of NM resident PI; nonowner licensed holder tells owner/licensee as expediently as possible, within 45 calendar days of discovery, subject to risk screen (§ 57-12C-6(A),(C)) |
|---|---|
| Breach and covered information | Unauthorized acquisition of unencrypted computerized PI, or encrypted data plus decryption key; name plus SSN, ID, financial-account access, or biometrics; public-data and good-faith employee exclusions (§ 57-12C-2(C),(D)) |
| Risk screen or notice exception | Appropriate investigation may find no significant risk of identity theft or fraud, removing resident or owner notice; GLBA/HIPAA-covered persons exempt from Act (§§ 57-12C-6(B),(C), 57-12C-8) |
| Individuals who receive notice | Each NM resident whose PI is reasonably believed subject to a security breach (§ 57-12C-6(A)) |
| Individual notice deadline and clock | Most expedient time possible, at most 45 calendar days after discovery; statutory investigation or police delay may apply (§§ 57-12C-6(A), 57-12C-9) |
| Regulator threshold and deadline | More than 1,000 NM residents notified for one breach: AG notice as expediently as possible, within 45 calendar days; send resident count and notice copy within 45 days after discovery; substitute notice also includes written AG notice (§§ 57-12C-10, 57-12C-6(E)) |
| Consumer-reporting-agency notice | More than 1,000 NM residents notified for one breach: notify major nationwide consumer-reporting agencies as expediently as possible, within 45 calendar days, subject to delay (§ 57-12C-10) |
| Individual delivery and content | US mail or qualifying electronic notice; identify notifier, data types and breach dates if known, incident, major agencies, and account/credit-report and federal-rights advice (§§ 57-12C-6(D), 57-12C-7) |
| Substitute notice conditions and channels | Cost over $100,000, over 50,000 residents, or no physical address/sufficient contacts: email valid addresses AND website if maintained AND written AG plus major NM media (§ 57-12C-6(D),(E)) |
| Delays and alternate compliance | Delay if police determine notice impedes criminal investigation, or as necessary to assess scope and restore system; timely own-policy route; GLBA/HIPAA exemption (§§ 57-12C-9, 57-12C-6(F), 57-12C-8) |
Requirements one by one
Breach and risk assessment
N.M. Stat. § 57-12C-2(C),(D) defines a breach as unauthorized acquisition of unencrypted computerized personal identifying information, or encrypted data together with the confidential means to decrypt it, compromising the information's security, confidentiality, or integrity. Covered combinations include a name and Social Security number, driver's license or other government ID, financial-account access data, or biometric data. Lawfully public information and an employee's good-faith acquisition for a legitimate business purpose without further unauthorized disclosure are excluded.
Under § 57-12C-6(B),(C), an appropriate investigation can establish that the breach creates no significant risk of identity theft or fraud. That finding removes resident notice and the nonowner's owner/licensee notice. Section 57-12C-8 exempts persons subject to the federal Gramm-Leach-Bliley Act or HIPAA from this Act.
Residents, owner, and state authorities
Section 57-12C-6(A) requires the owner or licensee to notify each New Mexico resident whose information is reasonably believed to have been affected, in the most expedient time possible and no later than 45 calendar days after discovery, subject to § 57-12C-9. A nonowner holder described in § 57-12C-6(C) tells the owner or licensee on the same discovery-based outer clock.
When one breach requires notice to more than 1,000 New Mexico residents, § 57-12C-10 also requires notice to the Attorney General and major nationwide consumer-reporting agencies, as expediently as possible and within 45 calendar days. The Attorney General submission must state the number of residents notified and include a copy of their notice within 45 calendar days after discovery. Section 57-12C-6(E) separately requires a written Attorney General notification when substitute notice is used.
Delivery and required message
Under § 57-12C-6(D),(E), resident notice may go by US mail or qualifying electronic delivery. Substitute notice is permitted when direct delivery would cost over $100,000, more than 50,000 residents need notice, or sufficient address/contact information is absent. It requires email to valid addresses held, conspicuous website posting if the holder maintains a site, and written notice to the Attorney General and major New Mexico media.
Section 57-12C-7 requires the notifier's identity and contact information, known categories of exposed information and breach date or range, a general incident description, major consumer-reporting-agency toll-free numbers and addresses, and advice to check accounts and credit reports and about federal credit-reporting rights.
What trips people up
The two Attorney General routes differ. The more than 1,000 resident threshold in § 57-12C-10 triggers a count and copy submission. Substitute notice under § 57-12C-6(E) also calls for written notice to that office, regardless of that threshold.
The 45-day clock has express delays. Section 57-12C-9 allows delay if law enforcement determines notice would impede a criminal investigation, or as necessary to establish breach scope and restore system integrity, security, and confidentiality. Section 57-12C-6(F) also recognizes timely notice under an entity's own information-security policy.
Common questions
Does the 45-day period begin after the investigation?
No. Section 57-12C-6(A),(C) measures it from discovery of the breach, subject to § 57-12C-9's stated delays.
Does the law cover an encrypted file if the key was also taken?
Yes. Section 57-12C-2(D) includes acquisition of encrypted computerized data and its confidential decryption process or key, if the other breach elements are met.
Statutes and sources
- N.M. Stat. § 57-12C-2 — definitions and exclusions.
- N.M. Stat. § 57-12C-6 — resident and owner notice, clock, methods, and substitute route.
- N.M. Stat. § 57-12C-7 — notice contents.
- N.M. Stat. § 57-12C-8 — federal-regulation exemption.
- N.M. Stat. § 57-12C-9 — delays.
- N.M. Stat. § 57-12C-10 — Attorney General and agency notice.
Current official compilation checked October 14, 2026.
Source links
Every statute quoted above, linked, with the date we checked it.
What does New Mexico law mean for your facts?
You just read the general rule. Ask your own question and see which parts of current New Mexico law apply to your situation, with citations you can check.
Try Ezel Pro free for 7 days. Cancel anytime before the trial ends and you pay nothing.
- Starts from the statutes this survey is built on
- Cites every source it relies on, so you can verify it
- Chat, drafting and research in one workspace