New Mexico
From US data breach notification laws: After a data breach, how fast must a business tell people, and who else must it tell?
Law: Data Breach Notification Act
The section that holds the state's general breach notification duty for businesses, as the source names it.
the Data Breach Notification Act
Source: https://www.nmlegis.gov/Sessions/17%20Regular/final/HB0015.pdf. Read 2026-11-01. Read once.
Days to tell residents: 45 days
The outer limit in days for telling affected residents, as stated. Blank where no number is stated. States start the clock differently, at discovery or at determining a breach happened, and the quote shows which.
not later than forty-five calendar days following discovery of the security breach
Source: https://www.nmlegis.gov/Sessions/17%20Regular/final/HB0015.pdf. Read 2026-11-01. Read once.
How fast, in the law's words: most expedient time possible
The law's own words for how quickly residents must be told, apart from any day count.
shall be made in the most expedient time possible
Source: https://www.nmlegis.gov/Sessions/17%20Regular/final/HB0015.pdf. Read 2026-11-01. Read once.
Attorney general told: Yes
Yes if the source says the state attorney general or its equivalent must be told of a breach in at least some cases. Florida's Department of Legal Affairs and Oregon's Attorney General count.
shall notify the office of the attorney general
Source: https://www.nmlegis.gov/Sessions/17%20Regular/final/HB0015.pdf. Read 2026-11-01. Read once.
Residents before the AG is told: 1000 residents
The number of affected residents at which the attorney general must be told, as stated. Blank where no number is stated. The quote shows whether it means that many or more than that many.
to more than one thousand New Mexico residents
Source: https://www.nmlegis.gov/Sessions/17%20Regular/final/HB0015.pdf. Read 2026-11-01. Read once.
Days to tell the AG: Not stated
The deadline in days for telling the attorney general, as stated. Blank where no number is stated. Clocks differ: some run from the breach, and others from telling residents, as the quote shows.
No source we could use stated this. A blank never means no.
Encrypted data excepted: Yes
Yes if the text limits the duty to unencrypted data, or leaves encrypted data out. Stolen keys can undo this in several states.
the unauthorized acquisition of unencrypted computerized data
Source: https://www.nmlegis.gov/Sessions/17%20Regular/final/HB0015.pdf. Read 2026-11-01. Read once.
Low-harm exception: Yes
Yes if the text lets a business skip notice after finding that harm or misuse is unlikely, or only counts breaches that create a real risk.
does not give rise to a significant risk of identity theft or fraud
Source: https://www.nmlegis.gov/Sessions/17%20Regular/final/HB0015.pdf. Read 2026-11-01. Read once.