What a New Mexico business has to have in writing
New Mexico has not adopted the NAIC insurance data security model law, and comprehensive privacy bills have been filed session after session without reaching the statute book, so the written-policy load lands mostly on employment and licensing. What the state does regulate on the data side is biometric data, which its breach act counts as personal identifying information.
The Healthy Workplaces Act makes every employer, however small, issue a written earned sick leave notice at hire and post the state notice, the Caregiver Leave Act forces any sick-leave policy to cover family care on the same terms, and the Criminal Offender Employment Act reaches employers with as few as four staff.
The Environment Department runs both the OSHA state plan and the statewide food handler card program.
New Mexico has a rule of its own in 8 of the 14 areas, listed below. In 5 more we searched the state's own site and found nothing beyond the federal rule; those are listed below with the pages we searched, so you can check our work. One area we have not checked yet.
Headcount
Industry General is always on
Share
Ad from the publisher
Policy Acknowledgment Proof
New MexicoHandbook 2026acknowledged by name
New Mexico on Recordwith AllyMatter
Cover New Mexico the Modern WayEvery policy New Mexico makes you write, acknowledged by name
01
Approve it, lock the version
Non-author approval, obsolete copies blocked
02
Every employee in New Mexico on record
Who read which version, and when
03
Walk into any state inspection with the trail
From $29/mo, 20 editors, unlimited staff (published)
New Mexico rules for a 15–19 person general business
We check the same 14 areas of state law on every state page: breach notification, data security program, consumer privacy law, biometric and health data, harassment prevention, workplace safety programs, workplace violence prevention, insurance data security, state vendor security program, paid leave policies, required postings, pay transparency, licensing and certifications, and other written policies. Federal rules apply in most of these already. What this page adds is whether New Mexico has a rule of its own on top. The federal rules every employer carries follow the New Mexico rules. Each row names what you must write, post, file or certify, who enforces it, and links to the authority.
Breach Notification 1Who you must tell after a data breach, and how fast
LawProduceWhat it requiresTriggerEnforced by
Data Breach Notification ActNMSA 1978, 57-12C-1 to 57-12C-12 #Any person that owns or licenses computerized personal identifying information about New Mexico residents; service providers that only maintain the data must tell the ownerDistribute
Notice
Notify affected New Mexico residents in the most expedient time possible and no later than 45 calendar days after discovering the breach, with a notice that names the company, lists the data types involved, gives the date of the incident, and explains credit reporting agency contacts and consumer rights. When more than 1,000 residents must be notified, also notify the Attorney General and the national consumer reporting agencies within the same 45 days.
From the first employee
New Mexico Attorney General (civil penalty up to $150,000)
Data Security Program 1A written safeguards program the state requires before anything goes wrong
LawProduceWhat it requiresTriggerEnforced by
Reasonable security procedures and secure disposal of personal identifying informationNMSA 1978, 57-12C-4; 57-12C-5; 57-12C-6 #Any person that owns or licenses personal identifying information about New Mexico residents, including those that hand the data to a service providerWrite
Written program
Keep reasonable administrative, technical and physical safeguards appropriate to the size of the business and the sensitivity of the data, shred, erase or otherwise make records unreadable when they are no longer needed for business purposes, and require service providers by contract to implement and maintain the same kind of safeguards.
From the first employee
New Mexico Attorney General
Biometric and Health Data 1Consent and retention rules for fingerprints, faces and health data
LawProduceWhat it requiresTriggerEnforced by
Biometric data as personal identifying information under the Data Breach Notification ActAccessed and verified 2026-10-01NMSA 1978, 57-12C-2 (definitions), 57-12C-4 (security), 57-12C-5 and 57-12C-6 (disposal and notice) #New Mexico has no standalone biometric privacy statute of the Illinois BIPA type and no consent regime for collecting biometrics. What does apply reaches any person or business, at any size, that owns or licenses biometric data about a New Mexico residentDistribute
Notice
Biometric data is defined as a record generated by automatic measurement of a person's fingerprints, voice print, iris or retina patterns, facial characteristics or hand geometry, used to authenticate identity when the person reaches a location, device, system or account. Because it sits inside personal identifying information, the reasonable-security and secure-disposal duties in the Act cover it, and a breach exposing it triggers notice to affected residents in the most expedient time possible and no later than 45 calendar days after discovery. A single breach reaching more than 1,000 New Mexico residents also has to be reported to the Attorney General and the major consumer reporting agencies inside the same 45 days.
From the first employee
New Mexico Attorney General
Workplace Safety Programs 1Written programs the state safety agency requires beyond federal OSHA
LawProduceWhat it requiresTriggerEnforced by
New Mexico Occupational Health and Safety Act (state plan)NMSA 1978, 50-9-1 et seq.; 11.5 NMAC; 29 CFR 1952 (New Mexico State Plan) #All private-sector and state and local government employers in New MexicoWrite
Written program
Follow the standards the Occupational Health and Safety Bureau adopts, including New Mexico rules that go beyond the federal set for areas such as trenching, post the state job safety and health poster, keep OSHA injury and illness records, report fatalities and hospitalizations within the federal deadlines, and maintain the written programs the adopted standards require, such as hazard communication and respiratory protection.
From the first employee
New Mexico Environment Department, Occupational Health and Safety Bureau
Paid Leave Policies 2Sick and family leave laws that come with a written policy or notice
LawProduceWhat it requiresTriggerEnforced by
Healthy Workplaces Act (earned sick leave)NMSA 1978, 50-17-1 to 50-17-12; 11.1.6 NMAC #Every private employer with employees working in New Mexico, regardless of sizeWrite + ack
Written policy
Let employees accrue one hour of earned sick leave for every 30 hours worked, up to 64 hours a year, give each employee written or electronic notice at hire covering accrual, use, the ban on retaliation and how to complain, in English, Spanish or another language spoken by a tenth of the workforce, post the Labor Relations Division notice at each establishment, and keep four years of accrual and use records.
From the first employee
New Mexico Department of Workforce Solutions, Labor Relations Division
Caregiver Leave ActNMSA 1978, 50-16-1 to 50-16-5 #Employers that offer sick leave for an employee's own illness; the right extends to caring for a family memberWrite
Written policy
Rewrite any sick leave policy so that accrued sick leave can be used to care for a family member's illness, injury or medical appointment on the same terms and with the same procedures as leave for the employee's own health, and do not retaliate against an employee who uses it that way.
From the first employee
New Mexico Department of Workforce Solutions, Labor Relations Division
Required Postings 1The notices every workplace in the state must display
LawProduceWhat it requiresTriggerEnforced by
Required workplace postingsNMSA 1978, 50-4-1 et seq.; 50-9-1 et seq.; 50-17-1 et seq.; 28-1-1 et seq.; 52-1-1 et seq. #Every New Mexico employerPost
Posting
Post the Labor Relations Division's notices in a conspicuous place at each worksite: minimum wage, paid sick leave, pay day and wage payment, child labor, human rights and equal opportunity, unemployment insurance, workers' compensation with the carrier details, and the Occupational Health and Safety Bureau job safety poster.
From the first employee
New Mexico Department of Workforce Solutions; Human Rights Bureau; Workers' Compensation Administration
Licensing and Certifications 1Registrations, licenses and certifications a business or its staff must hold
LawProduceWhat it requiresTriggerEnforced by
Business registration and state tax identificationNMSA 1978, Chapter 53 (corporations); Chapter 53, Article 19 (LLCs); Chapter 7, Article 1 (tax registration) #Corporations, LLCs, limited partnerships and foreign entities doing business in New Mexico, and any business with employees or gross receiptsFile
Filing / record
File the formation or foreign registration with the Secretary of State, name a registered agent, register with the Taxation and Revenue Department for a business tax identification number before making sales or paying wages, and file the corporate annual or biennial report. Municipal business registrations are separate.
From the first employee
New Mexico Secretary of State, Business Services Division; Taxation and Revenue Department
Other Written Policies 3Any other document the state makes an employer write or hand out
LawProduceWhat it requiresTriggerEnforced by
Criminal Offender Employment Act (ban the box)NMSA 1978, 28-2-1 et seq. #Private employers with 4 or more employees, and public employersWrite
Written policy
Remove any criminal history question from the written or electronic job application, and only raise arrest or conviction records after reviewing the application and discussing employment with the applicant. Notices that a specific criminal history could disqualify someone from a particular role are still allowed, so application forms and hiring procedures need rewriting rather than a new policy alone.
4+ employees
New Mexico Department of Workforce Solutions, Human Rights Bureau
Human Rights Act accommodations, including pregnancyNMSA 1978, 28-1-1 to 28-1-15 (28-1-7 unlawful discriminatory practices) #Employers with 4 or more employeesWrite
Written policy
Provide reasonable accommodation for conditions related to pregnancy, childbirth and related medical conditions unless it would be an undue hardship, avoid discrimination on the state's protected characteristics including sexual orientation and gender identity, and post the Human Rights Bureau notice. Employers generally record the accommodation process in a written policy and interactive-process file.
4+ employees
New Mexico Department of Workforce Solutions, Human Rights Bureau; New Mexico Human Rights Commission
Medical cannabis protection for qualified patientsNMSA 1978, 26-2B-9 #Every New Mexico employer that tests for drugs, except where the employer would lose a federal license or funding, or where the role is safety-sensitiveWrite
Written policy
Rewrite the drug testing and discipline policy so that a positive cannabis test alone is not grounds for refusing to hire or for adverse action against an enrolled medical cannabis patient, and record which positions the employer treats as safety-sensitive and why.
From the first employee
Private civil action; New Mexico Department of Health (patient program)
Because You Are in Construction 1Industry layer
LawProduceWhat it requiresTriggerEnforced by
Construction contractor licensingNMSA 1978, 60-13-1 et seq. (Construction Industries Licensing Act); 14.5 NMAC #Anyone who contracts for construction, electrical, mechanical or plumbing work in New Mexico above the statutory small-job thresholdCertify
Certification
Hold a Construction Industries Division license in the right classification before bidding or contracting, pass the trade and business exams, qualify a permanent employee as the qualifying party, keep the required bond and insurance, pull permits and pass inspections, and renew every three years with continuing education.
From the first employee
New Mexico Regulation and Licensing Department, Construction Industries Division
Because You Are in Food & Beverage 1Industry layer
LawProduceWhat it requiresTriggerEnforced by
Food establishment permit and food handler cardNMSA 1978, 25-1-1 et seq.; 7.6.2 NMAC (Food Service and Food Processing) #Food establishments in New Mexico and the people who handle food, utensils and food contact surfaces in themCertify
Certification
Hold a current Environment Department food establishment permit, renew it annually and pass inspections, and make sure every food employee obtains a food handler card within 30 days of hire unless they hold a certified food protection manager credential or qualify for an exemption. Keep the cards and certificates on file for the inspector.
From the first employee
New Mexico Environment Department, Food Program
No state law found 5Links verified5 of 5 searched on the official site, nothing found
Each line below is an area where we searched the state's own site and found no rule beyond the federal one. The link shows where we searched. It is not a law, and no one has reviewed these entries by hand yet, so treat them as our search rather than as a legal conclusion.
- Insurance Data Security where we looked ↗ also checked ↗New Mexico has not adopted the NAIC Insurance Data Security Model Law. The NAIC state page (Summer 2025) lists New Mexico under related activity only, for Bulletin 2024-04, a one-off data call after the Change Healthcare cyber attack, not a security rule. Insurers still fall under the general Data Breach Notification Act rows above.
- Harassment Prevention where we looked ↗The Human Rights Act (NMSA 1978, 28-1-7) prohibits harassment, but no New Mexico statute or Workforce Solutions rule requires a private employer to adopt a written harassment policy or run prevention training. The federal EEOC guidance that recommends both is best practice, not a mandate.
- Workplace Violence Prevention where we looked ↗ also checked ↗New Mexico's OSHA State Plan (Occupational Health and Safety Bureau) enforces the federal standards and has adopted no workplace violence prevention rule of its own, unlike California. Violence hazards fall under the federal General Duty Clause only.
- State Vendor Security Program where we looked ↗New Mexico runs no state cloud-security certification of its own (there is no NM-RAMP as Texas has TX-RAMP). Security requirements for vendors selling to the state sit in the Department of Information Technology's contract templates and are set contract by contract.
- Pay Transparency where we looked ↗No New Mexico statute requires pay ranges in job postings or on request. The Workforce Solutions wage and hour rules we searched cover minimum wage, overtime and paid sick leave, not pay disclosure.
Federal rules for a 15–19 person general business
Federal rules apply in every state, on top of the New Mexico rules above. New Mexico has an OSHA-approved State Plan covering private sector workers, so the state program enforces the workplace safety rows here and must be at least as effective as OSHA. OSHA State Plans ↗
From the publisher
Keep Your Written Policies in One Place
Whatever you are working toward, AllyMatter gets your policies approved, keeps every version and records who has read each one.
See how AllyMatter works ↗From $29/mo, 20 editors, unlimited staff
Your business type, with New Mexico on top
Small businessFederal + industry, with New Mexico on topConstruction contractorsFederal + industry, with New Mexico on topHealthcare practicesFederal + industry, with New Mexico on topFood and beverage businessesFederal + industry, with New Mexico on topTax and accounting firmsFederal + industry, with New Mexico on topRegistered investment advisersFederal + industry, with New Mexico on topInsurance agenciesFederal + industry, with New Mexico on topRetail and e-commerceFederal + industry, with New Mexico on topTrucking and logistics carriersFederal + industry, with New Mexico on topNonprofitsFederal + industry, with New Mexico on topFederal contractorsFederal + industry, with New Mexico on top
For another state
Alabama12Alaska12Arizona11Arkansas14California24Colorado18Connecticut17Delaware17District of Columbia12Florida15Georgia13Hawaii16Idaho13Illinois19Indiana16Iowa13Kansas11Kentucky14Louisiana13Maine15Maryland19Massachusetts16Michigan15Minnesota19Mississippi11Missouri12Montana15Nebraska13Nevada18New Hampshire13New Jersey19New York17North Carolina12North Dakota13Ohio13Oklahoma11Oregon19Pennsylvania12Rhode Island13South Carolina12South Dakota11Tennessee14Texas15Utah13Vermont17Virginia17Washington21West Virginia14Wisconsin15Wyoming13
Need a hand implementing it?
Find a Consultant Who Does This Work
Tell us what you need done and we will point you to firms that do this work. Your details go to a firm only when you choose it.
Sources
New Mexico Attorney GeneralNew Mexico Environment Department - Occupational Health and Safety BureauOSHA - New Mexico State PlanNew Mexico State Records Center - Title 11 NMACNew Mexico Department of Workforce SolutionsNew Mexico Department of Workforce Solutions - Paid Sick Leave Notice of Employee Rights posterNew Mexico Department of HealthNew Mexico Secretary of State - Business ServicesNew Mexico Taxation and Revenue Department - BusinessesNew Mexico Business Portal - Register a legal business structureNew Mexico Regulation and Licensing Department - Construction Industries DivisionNew Mexico Regulation and Licensing DepartmentNew Mexico Environment Department - Food Safety ProgramNew Mexico Environment Department - Food FAQsNew Mexico Legislature - House Bill 15 (2017) as enacted, the Data Breach Notification ActNew Mexico Legislature - Attorney General report on the data breach statute