Compare tool
Compare state data breach notification laws
Choose up to six states. Fields come from the PRC 2026 survey extract; blanks show as not extracted.
| Field | New Mexico |
|---|---|
| Statute citation | N.M. Stat. Ann. §§ 57-12C-1 to 57-12C-12 (Data Breach Notification Act) (amended 2017) |
| Individual notice timing | Not extracted in our PRC 2026 summary; check the statute. |
| Attorney general notice | Yes New Mexico requires Attorney General notification when a breach affects more than 1,000 residents, |
| Biometric data | Yes |
| Medical information | No |
| Government ID numbers | Not extracted |
| Paper records | No |
| Private right of action | No |
| Credit monitoring required | No |
| Breach definition (excerpt) | In New Mexico 'security breach' means the unauthorized acquisition of unencrypted computerized data, or of encrypted computerized data and the confidential process or key used to decrypt the encrypted computerized data, that compromises the security, confidentiality or integrity of personal identifying information maintained by a person. "Security breach" does not include the good-faith acquisition of personal identifying information by an employee or agent of a person for a legitimate business |