New Mexico data breach notification law and cyber insurance

What the statute requires

New Mexico requires businesses to notify affected residents within 45 days of discovering a breach, with Attorney General notice when more than 1,000 residents are affected. Cyber liability insurance typically covers the forensics, notification, and legal review this deadline demands.

Consumer notification deadline

In the most expedient time possible, but not later than 45 days following discovery of the breach

Regulator notice

Notify the New Mexico Attorney General within 45 days when a breach affects more than 1,000 residents.

Credit bureau notice

Notify consumer reporting agencies when a breach requires notice to more than 1,000 residents.

Safe harbor

Notification is not required if the compromised data was encrypted, or where an investigation finds no significant risk of identity theft or fraud.

Enforcement

Violations are enforceable by the Attorney General, who may seek injunctive relief and civil penalties subject to a statutory cap.

Statutes and sources

• New Mexico Data Breach Notification Act

  N.M. Stat. sect. 57-12C-1 et seq.

Regulator: New Mexico Attorney General . Last verified 2026-07-29 from the official source .

Cyber Liability in other states

• Alabama
• Alaska
• Arizona
• Arkansas
• California
• Colorado
• Connecticut
• Delaware
• District of Columbia
• Florida
• Georgia
• Hawaii
• Idaho
• Illinois
• Indiana
• Iowa
• Kansas
• Kentucky
• Louisiana
• Maine
• Maryland
• Massachusetts
• Michigan
• Minnesota
• Mississippi
• Missouri
• Montana
• Nebraska
• Nevada
• New Hampshire
• New Jersey
• New York
• North Carolina
• North Dakota
• Ohio
• Oklahoma
• Oregon
• Pennsylvania
• Rhode Island
• South Carolina
• South Dakota
• Tennessee
• Texas
• Utah
• Vermont
• Virginia
• Washington
• West Virginia
• Wisconsin
• Wyoming

Back to the cyber liability coverage guide