Data Breach Notification Act

NMSA 1978 Secs. 57-12C-1 to 57-12C-12

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

Commencement not set.

A breach notification rule binding private bodies.

As of 28 August 2026.

What it requires

Notify each affected New Mexico resident of a security breach involving their personal identifying information in the most expedient time possible and no later than 45 calendar days after discovery.
Notify the New Mexico Attorney General's office and major consumer reporting agencies if the breach affects more than 1,000 New Mexico residents.
Treat a fingerprint, voiceprint, iris or retina pattern, facial characteristic, or hand geometry record used to authenticate access to a location, device, system, or account as biometric data covered by this notice duty. A bare identifier extracted from a public recording for identification, rather than authentication, purposes may fall outside this statute's own biometric-data definition, which the text does not resolve either way.

If you get it wrong

Private right of actionNo

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

A person that owns or licenses computerized data including a New Mexico resident's personal identifying information must notify each affected resident of a security breach in the most expedient time possible and no later than 45 calendar days after discovery, and a breach affecting more than 1,000 New Mexico residents also triggers notice to the Attorney General's office and major consumer reporting agencies.

Personal identifying information includes biometric data, defined as a record generated by automatic measurement of fingerprints, a voiceprint, iris or retina patterns, facial characteristics, or hand geometry used to authenticate access to a physical location, device, system, or account, alongside a Social Security number, a driver's license number, and financial account information, and excludes information lawfully obtained from publicly available sources or government records.

The Act exempts the State of New Mexico and its political subdivisions entirely. The Attorney General has sole authority to bring an action for a violation, may obtain an injunction and damages for actual costs or losses, and may seek a civil penalty of the greater of $25,000 or $10 per failed notification up to $150,000; the Act creates no private right of action.

Enacted by Laws 2017, chapter 36 (House Bill 15); the enrolled bill text does not itself print an explicit commencement sentence, and secondary reporting gives June 16, 2017 without independent primary confirmation, so no effective date is recorded here.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot
automated_outreach
processes_biometrics
processes_voice

Read the law

official New Mexico enrolled bill text
House Bill 15 of 2017 (Laws 2017, ch. 36), New Mexico Legislature. The codified section numbers cannot be verified against this source: New Mexico's codified-statute portal (nmonesource.com) is client-rendered and serves no statute text, and the enrolled bill prints neither its own bill number nor the NMSA numbers its sections became, so the citation anchors appear nowhere in it. The section-by-section correspondence was verified by hand: each "SECTION N" of the bill maps 1:1 onto the codified section of the same ordinal.

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app