Data breach notification
New Mexico's rule is the Data Breach Notification Act, cited as N.M. Stat. Ann. ch. 57, art. 12C.
We read it in the bill as finally passed in the 2017 session, HB 15, on the New Mexico Legislature's site, because the compiled code was not reached.
Notice to residents shall be made in the most expedient time possible, but not later than forty-five calendar days following discovery of the security breach. The phrase sets two standards at once: speed first, and a hard ceiling behind it. A business that can send sooner is expected to.
A business that notifies more than one thousand New Mexico residents as a result of a single security breach shall also notify the office of the attorney general. The text we checked places that notice within 45 calendar days and names the major consumer reporting agencies as recipients too.
The act protects a first name or first initial and last name combined with listed elements when the data elements are not protected through encryption.
Notice is not required where the business determines that the security breach does not give rise to a significant risk of identity theft or fraud. Encrypted elements fall outside the definition, since coverage applies when the data elements are not protected through encryption. Beyond these two points, this page draws no further conclusion from the 2017 text. The 45-day limit is counted from discovery of the security breach, so the significant-risk question is weighed against a clock that has already started.
For documents you share through ShareAndGo, the activity log records every view and download, and watermarked view-only pages carry the reader's email address and the date.
The watermark setting is set per data room and is on by default. People reading documents confirm their email with a six-digit code and need no account. Each group sees its own folders and nothing else, and the chained log exports as CSV, which helps a New Mexico business count the people who opened a file inside ShareAndGo.
Checked against New Mexico's 2017 HB 15, as passed on November 2, 2026. This is general information, not legal advice.
