1. Home
  2. State breach laws
  3. New Mexico

New Mexico data breach notification law

What New Mexico requires when personal information is exposed: how fast residents must be notified, when the Attorney General has to be told, what it costs to get it wrong, and whether affected people can sue. Governed by N.M. Stat. Ann. §§ 57-12C-1 to 57-12C-12 (notification at § 57-12C-6).

45 days
Notification deadline
Required
AG notification
No
Private right of action
None
Liability protection

What this means if you sell security services

New Mexico's 45-day notification window means filings surface while remediation is still underway and the organization is still deciding what to change. Attorney General notice is required, and that filing is what puts the incident on the public record RiversideIQ tracks. The law itself gives individuals no right to sue, so the conversation centers on regulator penalties and remediation rather than lawsuits.

See recent New Mexico breach filings →

Requirements in detail

Statute
N.M. Stat. Ann. §§ 57-12C-1 to 57-12C-12 (notification at § 57-12C-6)
Deadline to notify residents
In the most expedient time possible, but no later than 45 calendar days after discovering the breach. Notice may be delayed at a law enforcement agency's request or as needed to determine the scope of the breach and restore the system, and is not required if an investigation finds no significant risk of identity theft or fraud.
Attorney General notification
Yes, if more than 1,000 New Mexico residents are notified because of a single breach. The Attorney General and the major consumer reporting agencies must be notified in the most expedient time possible and no later than 45 calendar days. The Attorney General must also receive the number of residents notified and a copy of the notice.
Penalties
The Attorney General enforces the law and can seek an injunction and damages for actual costs or losses. For knowing or reckless violations, courts can impose a civil penalty of $25,000, or $10 per failed notification if that is greater, up to a maximum of $150,000.
Private right of action
No. The breach notification law itself doesn't give individuals a right to sue; the Attorney General enforces it. People can still bring other claims after a breach, such as negligence.
Encryption exemption
New Mexico's notification requirements apply to unencrypted personal information. Encrypted data generally doesn't trigger notice unless the encryption key or credentials were also compromised.
Liability protection for security programs
None. New Mexico has no law limiting breach lawsuits for organizations that maintain a security program.

New Mexico breach notification FAQ

What is the data breach notification deadline in New Mexico?

In the most expedient time possible, but no later than 45 calendar days after discovering the breach. Notice may be delayed at a law enforcement agency's request or as needed to determine the scope of the breach and restore the system, and is not required if an investigation finds no significant risk of identity theft or fraud. The governing law is N.M. Stat. Ann. §§ 57-12C-1 to 57-12C-12 (notification at § 57-12C-6).

Does New Mexico require notifying the Attorney General of a data breach?

Yes, if more than 1,000 New Mexico residents are notified because of a single breach. The Attorney General and the major consumer reporting agencies must be notified in the most expedient time possible and no later than 45 calendar days. The Attorney General must also receive the number of residents notified and a copy of the notice.

What are the penalties for failing to report a data breach in New Mexico?

The Attorney General enforces the law and can seek an injunction and damages for actual costs or losses. For knowing or reckless violations, courts can impose a civil penalty of $25,000, or $10 per failed notification if that is greater, up to a maximum of $150,000.

Can individuals sue over a data breach in New Mexico?

No. The breach notification law itself doesn't give individuals a right to sue; the Attorney General enforces it. People can still bring other claims after a breach, such as negligence.

Does encrypted data need to be reported in New Mexico?

New Mexico's notification requirements apply to unencrypted personal information. Encrypted data generally doesn't trigger notice unless the encryption key or credentials were also compromised.

Does New Mexico limit breach lawsuits for companies with a cybersecurity program?

No. New Mexico has no law limiting breach lawsuits for organizations that maintain a security program.

Last reviewed October 5, 2026. This summary is for general information and is not legal advice. Statutes change; confirm current requirements with counsel or the New Mexico Attorney General before relying on them.

Other states with a 45-day deadline

Breach notification laws by state

Compare all 51 jurisdictions on the interactive map →·US data breach statistics →