Data Breach Notice to Residents and State Authorities in Hawaii
At a glance
| Covered entity and service provider | Owner/licensee of HI residents' PI, or HI-operating business owning/licensing PI in any form, tells affected person; HI-located/operating nonowner holder of residents' PI tells owner/licensee immediately (§ 487N-2(a)-(b)) |
|---|---|
| Breach and covered information | Unauthorized access AND acquisition of unencrypted/unredacted paper or electronic PI with illegal use or likely use and harm risk; name plus SSN, HI driver/ID, or financial access data; encrypted records plus key also breach (§§ 487N-1, 487N-2(a)) |
| Risk screen or notice exception | Breach definition requires illegal use or likely illegal use creating risk of harm for unencrypted data; encrypted data acquired with key separately counts; good-faith lawful employee acquisition excluded (§ 487N-1) |
| Individuals who receive notice | Affected person under owner's/licensor's HI-resident or HI-business route; provider gives owner/licensee notice, not substitute direct resident notice (§ 487N-2(a)-(b)) |
| Individual notice deadline and clock | Without unreasonable delay after discovery/notification; contact identification, scope investigation, and system restoration allowed; no fixed outside day count (§ 487N-2(a)) |
| Regulator threshold and deadline | If business notifies more than 1,000 persons at one time, written Office of Consumer Protection notice without unreasonable delay, stating notice timing, distribution, content; 20-day legislature report is government-only (§§ 487N-2(f), 487N-4) |
| Consumer-reporting-agency notice | Same more-than-1,000-at-one-time business trigger: written notice to all nationwide consumer-reporting agencies without unreasonable delay of notice timing, distribution, and content (§ 487N-2(f)) |
| Individual delivery and content | Clear, conspicuous notice by postal writing, consented qualifying email, or direct phone contact; describe incident, exposed PI, protection steps, assistance phone if any, and credit-report vigilance (§ 487N-2(d)-(e)) |
| Substitute notice conditions and channels | Cost over $100,000, affected class over 200,000, missing contact/consent, or unidentifiable people; all available email, website posting, AND statewide media; missing-contact/unknown routes cover only those persons (§ 487N-2(e)(4)) |
| Delays and alternate compliance | Law-enforcement written or contemporaneously documented delay request for criminal investigation/national security; resume when cleared. Specified federal financial or compliant HIPAA procedures satisfy; statutory waiver void (§ 487N-2(c),(g)-(h)) |
Requirements one by one
The covered business and breach test
Hawaii's § 487N-1 reaches personal information in records regardless of physical form. It pairs a person's name or first initial and surname with a Social Security number, Hawaii driver or ID number, or financial-account access information when either the name or linked element is unencrypted. Public government-record information is excluded.
An unencrypted or unredacted security breach requires unauthorized access and acquisition with illegal use or a reasonable likelihood of illegal use that creates a risk of harm. An incident involving encrypted records plus the confidential process or key separately counts as a breach (§ 487N-1).
Under § 487N-2(a), an owner or licensee of Hawaii residents' information, or a business operating in Hawaii that owns or licenses personal information in any form, tells the affected person. A Hawaii-located or Hawaii-operating nonowner holder of residents' information must instead notify the owner or licensee immediately after discovery (§ 487N-2(b)).
Timing, delivery, and contents
Section 487N-2(a) calls for notice without unreasonable delay after discovery or notification. The business may determine contacts and the breach's scope and restore the system's reasonable integrity, security, and confidentiality before sending. No outside number of days is stated.
The notice must be clear and conspicuous. It describes the incident, types of exposed information, general protective steps, an assistance telephone number if one exists, and advice to review account statements and free credit reports (§ 487N-2(d)). Section 487N-2(e) permits postal writing, qualifying email to people who agreed to electronic communications, or a telephone call that actually reaches the person.
When direct contact would cost over $100,000 or the affected class exceeds 200,000, substitute notice is available. It also applies to people lacking sufficient contact information or consent, or whom the business cannot identify; those last two routes cover only those people. The substitute combines email when addresses exist, a conspicuous website posting if maintained, and major statewide media (§ 487N-2(e)(4)).
Additional reports and alternate compliance
If a business notifies more than 1,000 people at one time, § 487N-2(f) requires written notice, without unreasonable delay, to the Office of Consumer Protection and all nationwide consumer-reporting agencies. It describes the notices' timing, distribution, and content. The separate 20-day legislature report in § 487N-4 applies to a government agency, not to this private-business reporting route.
Section 487N-2(g) deems qualifying financial institutions and compliant health plans or providers to meet this notice section through the specified federal regimes. Under subsection (h), a purported waiver of the statutory requirements is void.
What trips people up
A police request must be recorded. Section 487N-2(c) delays notice when law enforcement says it may impede a criminal investigation or jeopardize national security and asks for a delay. The request must be written or documented contemporaneously with the officer's name and agency. Notice resumes without unreasonable delay after the agency clears it.
Common questions
Does viewing a file without acquiring it meet the breach definition?
Section 487N-1 requires both unauthorized access and acquisition.
Can a business leave a voicemail instead of reaching the person?
Section 487N-2(e)(3) permits telephone notice only when contact is made directly with the affected person.
Does every breach require an Office of Consumer Protection report?
The business reporting trigger in § 487N-2(f) is notice to more than 1,000 people at one time.
Statutes and sources
- Haw. Rev. Stat. § 487N-1 — definitions and breach test.
- Haw. Rev. Stat. § 487N-2 — business and holder notices, timing, content, delivery, reporting, and alternatives.
- Haw. Rev. Stat. § 487N-4 — government-only legislature report.
Current official Hawaii Revised Statutes checked October 14, 2026.
Source links
Every statute quoted above, linked, with the date we checked it.
What does Hawaii law mean for your facts?
You just read the general rule. Ask your own question and see which parts of current Hawaii law apply to your situation, with citations you can check.
Try Ezel Pro free for 7 days. Cancel anytime before the trial ends and you pay nothing.
- Starts from the statutes this survey is built on
- Cites every source it relies on, so you can verify it
- Chat, drafting and research in one workspace