NM · Breach notification statute
New Mexico data breach notification law
Summary
- Statute citation
N.M. Stat. Ann. §§ 57-12C-1 to 57-12C-12 (Data Breach Notification Act) (amended 2017)
- Last amended
- 2017 (as stated in the citation)
- Source
- PRC Data Breach Notification Laws Survey 2026
Who must notify and when
Not extracted in our PRC 2026 summary; check the statute.
Attorney general notice
Yes New Mexico requires Attorney General notification when a breach affects more than 1,000 residents,
What counts as a breach
In New Mexico 'security breach' means the unauthorized acquisition of unencrypted computerized data, or of encrypted computerized data and the confidential process or key used to decrypt the encrypted computerized data, that compromises the security, confidentiality or integrity of personal identifying information maintained by a person. "Security breach" does not include the good-faith acquisition of personal identifying information by an employee or agent of a person for a legitimate business
What counts as personal information
Not extracted in our PRC 2026 summary; check the statute.
Coverage and remedies
"Not extracted" means the field was not captured in our PRC 2026 summary; check the statute.
HIPAA breaches reported in New Mexico
57 reports to HHS OCR affecting 4,378,605 individuals. Most common type: Hacking/IT Incident. See all HIPAA breaches in New Mexico.
Five largest
| Covered entity | Entity type | Individuals | Submitted | Type of breach | Status |
|---|---|---|---|---|---|
| UNM Health | Healthcare Provider | 1,228,093 | Aug 3, 2021 | Hacking/IT Incident | Archive (closed) |
| Presbyterian Healthcare Services | Healthcare Provider | 1,120,629 | Aug 2, 2019 | Hacking/IT Incident | Archive (closed) |
| Radiology Associates of Albuquerque, PA | Healthcare Provider | 616,211 | Sep 8, 2021 | Hacking/IT Incident | Archive (closed) |
| San Juan Regional Medical Center | Healthcare Provider | 325,660 | Jun 4, 2021 | Hacking/IT Incident | Archive (closed) |
| Rehoboth McKinley Christian Health Care Services | Healthcare Provider | 207,195 | May 19, 2021 | Hacking/IT Incident | Archive (closed) |
Frequently asked questions
Does New Mexico require notice to the attorney general?
The PRC 2026 extract notes: "Yes New Mexico requires Attorney General notification when a breach affects more than 1,000 residents,". (Source: PRC 2026 survey extract.)
Does the New Mexico law cover biometric data?
Yes. The PRC 2026 survey records biometric data as covered by the New Mexico breach law.
Does the New Mexico law cover medical information?
No. The PRC 2026 survey does not record medical information as covered by the New Mexico breach law.
Does the New Mexico law cover paper records?
No. The PRC 2026 survey records the New Mexico law as covering computerised data only, not paper records.
Is there a private right of action in New Mexico?
No. The PRC 2026 survey does not record a private right of action under the New Mexico breach law.
Is credit monitoring required in New Mexico?
No. The PRC 2026 survey does not record a credit monitoring requirement in New Mexico.
How does the New Mexico law relate to HIPAA?
HIPAA covered entities and business associates follow the federal HIPAA Breach Notification Rule for protected health information. State breach laws can apply alongside it, and some state statutes treat HIPAA compliance as satisfying state duties. Check the New Mexico statute, and see our HIPAA vs state breach notification laws guide.
Sources
- Privacy Rights Clearinghouse, Data Breach Notification Laws Survey 2026 (laws as of 1 January 2026): privacyrights.org
- The New Mexico state legislature website for the current text of the statute.
- HHS OCR Breach Portal: ocrportal.hhs.gov
- Further reading: NCSL security breach notification laws