Law / United States / New Mexico
Data Breach Notification Act, security and disposal duties
NMSA 1978 Secs. 57-12C-3 to 57-12C-5
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
Commencement not set.
A security baseline statutes rule binding private bodies.
As of 16 September 2026.
What it requires
- This binds any person that owns or licenses records containing the personal identifying information of a New Mexico resident, or that discloses that information to a service provider under contract; it does not bind the State of New Mexico or any of its political subdivisions.
- Implement and maintain reasonable security procedures and practices, appropriate to the nature of the personal identifying information held, to protect it from unauthorized access, destruction, use, modification, or disclosure.
- Arrange for proper disposal, shredding, erasing, or otherwise rendering the information unreadable or undecipherable, of records containing personal identifying information once they are no longer reasonably needed for business purposes.
- Where personal identifying information is disclosed to a service provider under a contract, require by that contract that the service provider also implement and maintain reasonable security procedures and practices appropriate to the nature of the information.
- There is no private right of action; only the Attorney General may enforce this duty, seeking an injunction, damages for actual costs or losses, and, where the violation was knowing or reckless, a civil penalty of $25,000. A separate, higher penalty schedule tied to a count of failed notifications governs this Act's notification duty alone, this jurisdiction's privacy row, and does not apply to a violation of the security or disposal duty described here.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Penalty structure
NMSA 1978 Sec. 57-12C-11(C) makes this $25,000 civil penalty available only where the court finds the violation knowing or reckless; an ordinary violation draws only the injunction and actual-costs-or-losses damages available under Sec. 57-12C-11(B). The same subsection also lets the court impose, in the case of failed notification, $10 per instance up to $150,000 in place of the flat $25,000 if that figure is greater; that per-instance alternative has no application to a violation of the security-procedures or disposal duty described here, which involves no notification to count, and it governs this Act's own notification duty, this jurisdiction's privacy row, instead.
- Rule
- Fixed only
- As of
- 16 September 2026
- Currency
- USD
- Fixed cap
- 25,000
Who enforces it
Enforcement body
New Mexico Attorney General; NMSA 1978 Sec. 57-12C-11(A) confines standing to the Attorney General, acting on behalf of individuals and in the name of the state, with no dedicated regulator distinct from that authority and no published enforcement record located for this duty specifically.
What it reaches
Obligation class
Security
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
A person that owns or licenses personal identifying information of a New Mexico resident must implement and maintain reasonable security procedures and practices appropriate to the nature of the information to protect it from unauthorized access, destruction, use, modification, or disclosure.
The same person must arrange for proper disposal, meaning shredding, erasing, or otherwise modifying the information to make it unreadable or undecipherable, of records containing personal identifying information once they are no longer reasonably needed for business purposes.
Where a person discloses personal identifying information to a service provider under contract, that contract must require the service provider to implement and maintain the same reasonable security procedures and practices.
The Act exempts the State of New Mexico and its political subdivisions entirely, and enforcement is confined to the Attorney General, who may obtain an injunction, damages for actual costs or losses, and, for a knowing or reckless violation, a civil penalty of $25,000; the Act creates no private right of action. Enacted by Laws 2017, chapter 36 (House Bill 15); the enrolled bill text does not itself print an explicit commencement sentence, so no effective date is recorded here.
When LexLint raises it
crawls_webtrains_modelsdeploys_chatbotautomated_outreachhigh_risk_decisionsprocesses_voiceprocesses_biometricsserves_minorsoperates_social_platformships_mobile_appdistributes_software_product
Read the law
official New Mexico enrolled bill text
House Bill 15 of 2017 (Laws 2017, ch. 36), New Mexico Legislature, the same Act whose notification duty (Sec. 57-12C-6) is this jurisdiction's privacy row. The codified section numbers cannot be verified against this source: New Mexico's codified-statute portal (nmonesource.com) is client-rendered and serves no statute text, and the enrolled bill prints neither its own bill number nor the NMSA numbers its sections became, so the citation anchors appear nowhere in it. The section-by-section correspondence was verified by hand: each SECTION N of the bill maps 1:1 onto the codified section of the same ordinal.