language: en · status: in-force · last checked: 2026-10-08

New Mexico — Data Breach Notification Act (NMSA 1978, §§57-12C-1 to 57-12C-12)

Enacted by Laws 2017, chapter 36. New Mexico has no student-data privacy statute (see the research note). This general act is the New Mexico law that binds an edtech supplier directly. A person that owns or licenses a New Mexico resident's personal identifying information must dispose of it properly and keep reasonable security. Anyone that only holds the data for someone else must tell the owner of a breach within 45 days. Owners must notify residents within 45 days, and the Attorney General and credit reporting agencies if more than 1,000 residents are affected. The State and its political subdivisions are exempt.

Applicability to EdTech

• School districts are outside the act; their suppliers are not. "Nothing in the Data Breach Notification Act shall be interpreted to apply to the state of New Mexico or any of its political subdivisions" (§57-12C-12). A public school district is not bound, so the district-side contract duty in §57-12C-5 does not reach it. A private vendor holding pupils' data is a "person" under the act and carries its own duties.
• Voice prints and facial measurements count when used to authenticate. "Biometric data" is "a record generated by automatic measurements of an identified individual's fingerprints, voice print, iris or retina patterns, facial characteristics or hand geometry that is used to uniquely and durably authenticate an individual's identity when the individual accesses a physical location, device, system or account" (§57-12C-2(A)). Combined with a name, it is personal identifying information (§57-12C-2(C)(1)(e)). Voice or face recognition used to log a pupil in to a device falls within the definition. Speech processing that does not authenticate does not.
• A processor's duty is to tell the owner. A person "licensed to maintain or possess computerized data containing personal identifying information … that the person does not own or license" must notify the owner or licensee of a breach "in the most expedient time possible, but not later than forty-five calendar days following discovery", unless an investigation finds no significant risk of identity theft or fraud (§57-12C-6(C)).
• Reasonable security and proper disposal apply to any person that owns or licenses the information (§57-12C-3, §57-12C-4). A person disclosing it to a "service provider" (defined in §57-12C-2(E)) must require equivalent security by contract (§57-12C-5).

Contents

Key obligations at a glance

• Proper disposal; reasonable security — §57-12C-3, §57-12C-4.
• Bind service providers to reasonable security by contract — §57-12C-5.
• Notify residents within 45 days; a data holder notifies the owner within 45 days — §57-12C-6; content of the notice — §57-12C-7.
• Over 1,000 residents: notify the Attorney General and credit reporting agencies — §57-12C-10.

Enforcement

The Attorney General may sue on behalf of individuals and in the name of the State; the court may grant an injunction and damages, and for a knowing or reckless violation a civil penalty of the greater of $25,000 or, for failed notification, $10 per instance up to $150,000 (§57-12C-11).

Licence

The corpus reproduces Article 12C verbatim from the New Mexico Compilation Commission's compiled PDF of NMSA 1978 Chapter 57, served by NMOneSource (read 2026-10-08). The PDF carries no copyright notice (checked in full). The Compilation Commission's annotations are not reproduced.

Statute text enacted by a state legislature is outside copyright under the government edicts doctrine. In Georgia v. Public.Resource.Org, Inc., 590 U.S. 255 (2020) (slip opinion, read 2026-10-01), the Supreme Court held: "Under what has been dubbed the government edicts doctrine, officials empowered to speak with the force of law cannot be the authors of—and therefore cannot copyright—the works they create in the course of their official duties." It applied the doctrine to an arm of the legislature as well as to legislators: "Because Georgia’s annotations are authored by an arm of the legislature in the course of its legislative duties, the government edicts doctrine puts them outside the reach of copyright protection." The History credits record the enacting session law and are part of the official compilation's text of each section.

Conditions: none attach to the statute text. The corpus nonetheless names the official source in its Sources section and in the fact document's {.meta} provenance lines, and its Meta section describes what it changed (annotations dropped, whitespace collapsed, anchors added, nothing reworded).

Related

• New Mexico student data privacy (research note) — what was searched for a student-specific statute, and found
• Kentucky personal information security (KRS 61.931–61.933) — a breach regime that, unlike New Mexico's, reaches school districts and their suppliers by name

Sources

• New Mexico Compilation Commission — NMOneSource, NMSA 1978 Chapter 57 — compiled chapter PDF at document.do