New Mexico. Breach notification. Act
NM breach lawNew Mexico data breach notification law (N.M. Stat. §§ 57-12C-1 et seq. (Data Breach Notification Act))
Partly verified
Medium confidence.Penalty figures from recollection of § 57-12C-11; summary page did not state amounts.
§1Summary
- Synopsis
Requires businesses (and in most cases public bodies) that own or license computerised personal information about New Mexico residents to notify affected individuals after a security breach. Core timing rule: Individuals within 45 calendar days of discovery. Covered data: name plus SSN, driver's licence, government ID, financial account with codes, biometric data.
- Key themes
- Unique features
Vendor bound by the same 45-day clock; includes biometrics; requires reasonable security and vendor contracts.
- SaaS relevance
A SaaS provider hosting customer data is usually the 'maintaining' entity, not the owner: New Mexico requires a service provider to notify the owner within 45 days of discovery and requires owners to contractually bind providers to reasonable security. The owner customer then carries the individual and regulator notices, so contracts should fix timelines and cooperation.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- Individuals within 45 calendar days of discovery; AG and CRAs within 45 days if >1,000
- DPO
- No
- Cross-border transfers
- None
- Maximum penalty
- Up to $25,000 per violation, or $10 per failed notification capped at $150,000
§3Dates
- Key dates
- Adopted
- In force
- No amendment identified since enactment
§4Text and authority
- Text
- Authoritative text nmonesource.com
- Authority
- New Mexico Attorney General
§5Where it applies
- Domestic law of
- New Mexico
§6Sources and verification
- Sources consulted
- Verification
Medium confidence.
Partly verified
Medium confidence.Penalty figures from recollection of § 57-12C-11; summary page did not state amounts.