New Mexico has become the 48th state to require companies to notify individuals when a breach of their personal identifying information occurs.
The Data Breach Notification Act requires companies to use reasonable security procedures and practices to protect the PII of New Mexico residents and to notify individuals of a breach of their PII within 45 days. The act was signed into law on April 6, 2017.
Data breach laws vary by state, and the applicable law is that of the state where the impacted individuals reside. Unless and until a federal law creates a single data breach notification standard, companies must understand how to comply with each applicable state law. New Mexico’s new law has several unique characteristics.
Excerpted from Law360. To read the full article, please click here (subscription required).