New Mexico
Privacy Law Status
Comprehensive Privacy Law
New Mexico currently does not have a comprehensive consumer data privacy law in effect[1]. Unlike states such as California, Virginia, and Colorado, New Mexico residents do not have broad statutory rights to control how businesses collect, use, and share their personal information. The state has only limited privacy protections through its breach notification requirements and general consumer protection laws.
New Mexico was notably late to adopt even basic data breach notification requirements, becoming the 48th state to enact such a law in 2017[1]. This delay reflects the state’s historically cautious approach to privacy regulation, leaving residents with fewer protections than most other states provide.
Legislative Activity
Multiple privacy bills were introduced in the New Mexico Legislature during 2025, representing the most significant privacy legislative activity in the state’s history[2]. Three major bills were proposed: HB 307 (Internet Privacy and Safety Act), HB 410 (Consumer Information and Data Protection Act), and SB 420 (Community Privacy and Safety Act). These bills would have established comprehensive privacy rights similar to those found in leading privacy states.
Unfortunately, all three bills have become inactive and did not advance through the legislative process[2]. This continues a pattern from 2019, when SB 176 (Consumer Information Privacy Act) was introduced but indefinitely postponed[1][3]. The repeated failure of privacy legislation suggests ongoing challenges in building sufficient legislative support for comprehensive privacy protections in New Mexico.
Implementation Timeline
There is currently no timeline for comprehensive privacy law implementation in New Mexico, as no such legislation has been enacted. The inactive status of the 2025 privacy bills means residents will continue to rely on limited existing protections for the foreseeable future.
Future legislative sessions may see renewed efforts to pass privacy legislation, but there are no confirmed plans or schedules for when comprehensive privacy protections might be enacted. New Mexico residents seeking strong privacy protections may need to wait for federal privacy legislation or continue advocating for state-level action in upcoming legislative sessions.
Your Rights as a New Mexico Resident
New Mexico residents currently have very limited statutory privacy rights compared to residents of comprehensive privacy law states. Your existing protections are minimal and primarily focus on data breaches rather than ongoing data practices.
- Right to breach notification: You must be notified within 45 days if a business experiences a data breach that compromises your personal information, provided there is a reasonable risk of harm[4]
- Right to consumer protection: You can file complaints with the Attorney General’s Consumer Protection Bureau for unfair or deceptive business practices that may include privacy violations[5]
- Limited right to civil action: You can sue for damages if your communications are unlawfully intercepted under New Mexico’s wiretapping statute, with minimum damages of $1,000[6]
- No comprehensive data rights: Unlike residents of states with privacy laws, you do not have statutory rights to access, delete, correct, or control the sale of your personal information by businesses
- No protection against discrimination: You have no specific legal protection against businesses using your personal data to discriminate against you in employment, housing, or services
These limited rights mean that most data privacy protections for New Mexico residents must come from federal laws (like HIPAA for health data), voluntary business practices, or your own privacy-protective behaviors.
Business Requirements
New Mexico imposes minimal data privacy requirements on businesses operating in the state, creating an environment with fewer protections for consumers than found in comprehensive privacy law states.
- Data breach notification only: Businesses must notify affected New Mexico residents within 45 days of discovering a data breach that compromises personal information and poses a reasonable risk of harm[4]
- Attorney General notification: Companies experiencing breaches affecting more than 1,000 New Mexico residents must also notify the state Attorney General and major credit reporting agencies[4]
- No comprehensive disclosure requirements: Unlike privacy law states, businesses are not required to provide detailed privacy notices explaining what data they collect, how they use it, or with whom they share it
- No consumer request procedures: Businesses have no legal obligation to respond to consumer requests to access, delete, correct, or control their personal information
- No data minimization requirements: Companies can collect and retain personal information without statutory limits on necessity or retention periods
- No specific security standards: Beyond general consumer protection law requirements, businesses face no specific data security mandates or risk assessment obligations
Practical Impact
- Limited daily privacy protection: Without comprehensive privacy laws, New Mexico residents have little legal recourse when businesses collect excessive personal information, share data without permission, or use information in unexpected ways
- Breach response only: Your main protection occurs after something goes wrong—you’ll be notified of data breaches, but have limited ability to prevent problematic data practices before breaches occur
- Consumer protection complaints: If you believe a business has violated your privacy through unfair or deceptive practices, you can file a complaint with the Attorney General’s Consumer Protection Bureau, though privacy-specific remedies are limited[5]
- Reliance on federal protections: You must rely on federal laws like HIPAA (health data), GLBA (financial data), and COPPA (children’s data) for sector-specific privacy protections
- Voluntary business practices: Many privacy protections depend on companies’ voluntary policies rather than legal requirements, leaving you vulnerable if businesses change their practices
- Limited enforcement mechanisms: Unlike states with private rights of action, you generally cannot sue businesses directly for privacy violations—enforcement depends primarily on government action
Comparison Context
- Behind leading privacy states: New Mexico residents lack the comprehensive rights available in California, Virginia, Colorado, Connecticut, and other privacy law states, including rights to access, delete, correct, and control personal data
- No private enforcement: Unlike California’s CCPA, New Mexico provides no private right of action allowing individuals to sue businesses for privacy violations, limiting enforcement options
- Weaker than emerging standards: The failed 2025 bills would have included modern privacy protections like data minimization, algorithmic accountability, and special protections for sensitive data—rights that residents in other states increasingly enjoy
- Limited children’s protections: While some states are enacting enhanced online safety protections for minors, New Mexico children rely only on federal COPPA protections and general consumer protection laws
- No health data specificity: States like Washington have enacted specific health data privacy laws, while New Mexico residents rely on federal HIPAA protections that don’t cover all health-related information
- Breach notification timing: New Mexico’s 45-day breach notification requirement is longer than some states but shorter than the federal HIPAA requirement of 60 days[4]
Action Steps for Residents
- Contact your legislators: Advocate for comprehensive privacy legislation by contacting your state representatives and senators about the importance of consumer privacy protections
- Use available federal rights: Exercise your rights under federal laws like HIPAA (request your medical records), FERPA (access educational records), and FCRA (check your credit reports)
- File consumer complaints: Report privacy-related unfair or deceptive business practices to the Attorney General’s Consumer Protection Bureau through their online complaint system
- Practice privacy self-defense: Use privacy-protective settings on social media, limit information sharing with businesses, regularly review account privacy settings, and be cautious about what personal information you provide
- Support privacy legislation: Stay informed about future privacy bills in the New Mexico Legislature and participate in public comment periods when they become available
- Monitor your data: Regularly check for data breaches affecting your information using free breach notification services and monitor your credit reports for unauthorized activity
Official Resources and Contact Information
New Mexico Legislature
Contact your state legislators to advocate for comprehensive privacy legislation. The Legislative Council Service provides general information about the legislature and can help you find your specific representatives.
Phone: (505) 986-4300 (legislative switchboard during sessions)
Email: lcs@nmlegis.gov
Website: www.nmlegis.gov
Find Your Legislators
Use the official legislature website to identify your specific state representative and senator based on your address.
Find Your Legislator: www.nmlegis.gov/members/find_my_legislator
Attorney General’s Office – Consumer Protection
The Consumer Affairs Division handles consumer protection complaints and can investigate unfair or deceptive business practices that may include privacy violations.
Santa Fe Office:
408 Galisteo Street, Villagra Building
Santa Fe, NM 87501
Phone: (505) 490-4060
Albuquerque Office:
201 3rd St. NW, Suite 300
Albuquerque, NM 87102
Phone: (505) 490-4060
Las Cruces Office:
1175 Commerce Dr, Suite A
Las Cruces, NM 88011
Phone: (505) 490-4060
Filing Consumer Complaints
Report privacy-related unfair or deceptive business practices through the Attorney General’s electronic complaint system or paper forms.
Online Complaints: nmdoj.gov/get-help/submit-a-complaint
Consumer Protection Information: nmdoj.gov/about-the-office/consumer-affairs
Legislative Information and Public Records
Access information about current and proposed legislation, committee meetings, and legislative documents.
Bill Tracking: www.nmlegis.gov
Public Records Requests: Contact the Attorney General’s Open Government Division at (505) 490-4060 for questions about accessing government records related to privacy policy development
Sources and Citations
Last Updated August 2025. Written with contributions from both human authors and Perplexity AI. If you find incorrect or outdated information let us know at support@optery.com.