EdLaw
New Mexico — student data privacy (research note: no dedicated statute)
Research finding, 2026-10-08: New Mexico has no student-data privacy statute binding an edtech operator or vendor in the current NMSA 1978. No SOPIPA-style operator act was found, and no records statute binds contractors. The lead this note was opened on, a "Student Data Privacy Act" at NMSA 1978 Chapter 22, Article 7C, does not exist: Chapter 22 has no Article 7C.
What was searched
- NMSA 1978 Chapter 22 (Public Schools), in full. The New Mexico Compilation Commission's compiled chapter PDF, served by NMOneSource at
nmos/nmsa/en/4368/1/document.do(1,014 pages, read 2026-10-08). Its article headings run 1, 2, 2A, 2C–2F, 3, 3A, 3B, 4, 4A, 5, 5A, 7, 8, … with no Article 7C. A full-text search for "privacy", "student data" and "operator" finds only provisions binding the State and schools. Among them: the educational data system's privacy duties in §22-1-11; the requirement that a district or charter school offering a full-time distance learning programme "administer the program in compliance with state and federal law regarding student privacy, student record confidentiality and secure student record storage" (§22-30-5(A)(2)); and the "protections for student privacy and confidentiality" a district’s wireless communication device policy may provide (§22-1-17). None imposes a duty on a vendor. - The Future of Privacy Forum's state student-privacy law tracker (read 2026-10-08) lists enactments for Maryland, Minnesota, Nevada, Arizona and Arkansas, and none for New Mexico. It is a lead, not a source.
- 2018 HB 84 was checked as a candidate, through its Internet Archive capture, since nmlegis.gov answers this network with a Check Point "UserCheck" block page. It amends §22-1-11 to restrict the use of social security numbers. It is not a vendor statute.
What does bind a supplier
The New Mexico statute that binds an edtech supplier directly is the general Data Breach Notification Act (NMSA 1978, §§57-12C-1 to 57-12C-12). It covers reasonable security, voice prints and facial measurements used for authentication, and the 45-day notice to the data owner. The act exempts the State and its political subdivisions, so school districts are not bound by it, and duties to a district come from FERPA and the contract.
Licence
The corpus reproduces no statute text here. This README is a research note recording a negative finding; the few phrases it quotes from NMSA 1978 Chapter 22 are statute text, outside copyright under the government edicts doctrine, as set out for the Data Breach Notification Act.
Conditions: none.
Related
- New Mexico Data Breach Notification Act — the operative supplier-facing statute
- FERPA — the federal layer that governs New Mexico districts' education records
- Alabama student data governance (research note) — the corpus's other no-statute finding of this kind