NEW MEXICO
FINES & PENALTIES
Violations
$25,000 – $150,000
BREACH NOTIFICATION
Mandated Timeframe
Within 45 days
BREACH REPORTING
For breaches involving more than 1,000 New Mexico residents, reporting must be made within 45 days to the Attorney General and major consumer reporting agencies.
CONSUMER NOTIFICATION
There are specifically defined requirements for consumer notification. If your breach affects residents in other jurisdictions, those individuals must be notified based on the breach notification laws of the jurisdiction where they reside.
FINES & PENALTIES
Organizations may be fined or penalized for Vendor violations. The Attorney General may bring an action on the behalf of individuals and in the name of the state alleging a violation; an injunction may be issued and/or damages awarded for actual costs or losses, including consequential financial losses.
PRIVACY PROGRAM
Organizations must contract with Vendors to whom the Organization discloses personal information.
VENDOR/3RD PARTIES
A vendor discovering a breach or suspected breach must notify the data owner no later than 45 days after discovery. The data owner is responsible for reporting to the regulator and consumer notification. Vendors have a contractual obligation to have procedures and practices in place for the security and protection of personal information from unauthorized access, destruction, use, modification or disclosure.