Comprehensive Data-Breach Notification Letter (Hawaii)

Template – Court-Ready Draft

[// GUIDANCE: This template contains TWO letters:
(A) “Regulator Notice” – to the Hawaiʻi Department of Commerce & Consumer Affairs, Office of Consumer Protection (“OCP”) (often the enforcement arm for the Attorney General) – and
(B) “Consumer Notice” – to each affected Hawaiʻi resident.
Attorneys may detach and use either letter independently or as an exhibit to multi-state notices.]

TABLE OF CONTENTS

1. Document Header
2. Definitions
3. Regulator Notice (OCP)
4. Consumer Notice (Hawaiʻi Residents)
5. Execution Block

1. DOCUMENT HEADER

Title:
Notice of Security Breach Pursuant to Haw. Rev. Stat. § 487N-2

Parties:
• “Company” – [LEGAL NAME OF BUSINESS], a [STATE OF ORG] [ENTITY TYPE]
• “Regulator” – Director, Hawaiʻi Department of Commerce & Consumer Affairs, Office of Consumer Protection (“OCP”)
• “Consumers” – Each Affected Hawaiʻi Resident listed in Exhibit A

Effective Date (“Notice Date”): [DATE OF LETTER]

Governing Law / Venue: State of Hawaiʻi courts (pursuant to state_data_breach_law)

2. DEFINITIONS

1. “Breach” or “Security Breach” – The unauthorized acquisition of unencrypted or unredacted Personal Information that compromises the security, confidentiality, or integrity of that information, as defined in Haw. Rev. Stat. § 487N-1.
2. “Personal Information” – An individual’s first name or first initial and last name in combination with any one or more of the data elements specified in Haw. Rev. Stat. § 487N-1, when either the name or the data elements are not encrypted, redacted, or otherwise protected by another method rendering the data unreadable or unusable.
3. “Incident Date” – The earliest date on which Company reasonably believes the Breach first occurred: [INCIDENT DATE OR DATE RANGE].
4. “Discovery Date” – The date on which Company first became aware of facts indicating a Breach: [DISCOVERY DATE].

[// GUIDANCE: Revise, add, or delete definitions as needed to align with the facts and to match the defined-term capitalization used throughout.]

3. REGULATOR NOTICE (OCP)

[On Company Letterhead]

To:
Director
Office of Consumer Protection
Department of Commerce and Consumer Affairs
335 Merchant Street, Room 310
Honolulu, Hawaiʻi 96813

Re: Security Breach Notification – Sample Consumer Notice Enclosed

Dear Director [LAST NAME]:

1. Purpose. Pursuant to Haw. Rev. Stat. § 487N-2(e), Company hereby provides (i) written notice of the timing, distribution, and content of the consumer notice related to a recent Security Breach, and (ii) a sample copy of the consumer notice letter that will be sent contemporaneously to affected Hawaiʻi residents.

2. Incident Overview.
   a. Incident Date: [INCIDENT DATE OR RANGE]
   b. Discovery Date: [DISCOVERY DATE]
   c. Description (General): [BRIEF NARRATIVE OF HOW THE BREACH OCCURRED—e.g., “On March 9, 2025, Company detected unauthorized access to a legacy customer database hosted by a third-party cloud provider.”]
   d. Number of Affected Hawaiʻi Residents: [ESTIMATE OR EXACT NUMBER]

3. Categories of Personal Information Impacted. The Breach involved the following data elements, unencrypted and unredacted:
   • [e.g., Social Security number]
   • [e.g., Driver’s license or Hawaiʻi state identification card number]
   • [e.g., Financial account number, with password/PIN]

4. Law-Enforcement Coordination. Company has consulted with [LAW-ENFORCEMENT AGENCY, if any]. No delay was requested, and notification is therefore being provided without unreasonable delay.

5. Mitigation & Remediation Steps. Since discovery, Company has:
   • Contained and eradicated malicious access;
   • Rotated system credentials and implemented MFA;
   • Engaged third-party cybersecurity forensics;
   • Offered complimentary credit monitoring and identity-theft protection to all impacted individuals for [X] months.

6. Notification Schedule. Consumer notices will be mailed (first-class) and emailed, where an address is on file, beginning on [MM/DD/YYYY] and completed no later than [MM/DD/YYYY].

7. Consumer Notice Content. A sample letter appears in Section 4 below (and is enclosed as Exhibit B).

8. Contact Information. Please contact [NAME], [TITLE], at [PHONE] or [EMAIL] for any follow-up.

Respectfully submitted,

[NAME OF AUTHORIZED SIGNATORY]
[TITLE]
[COMPANY LEGAL NAME]

4. CONSUMER NOTICE (Hawaiʻi Residents)

[On Company Letterhead]

[CONSUMER NAME]
[ADDRESS]
[CITY, STATE ZIP]

Notice Date: [MM/DD/YYYY]

Subject: Important Notice of Data Security Breach

Dear [CONSUMER FIRST NAME] [CONSUMER LAST NAME]:

1. What Happened?
   On [INCIDENT DATE OR RANGE], Company discovered that an unauthorized party gained access to certain Company systems. Following an expedited investigation with independent cybersecurity professionals, we confirmed on [DISCOVERY DATE] that specific files containing your Personal Information were accessed or acquired without authorization.

2. What Information Was Involved?
   Based on our investigation, the following unencrypted information relating to you may have been involved:
   • [SOCIAL SECURITY NUMBER]
   • [DRIVER’S LICENSE NUMBER / HAWAIʻI STATE ID]
   • [FINANCIAL ACCOUNT DETAILS, IF APPLICABLE]
   We have no evidence at this time of fraudulent use; however, out of an abundance of caution, we are notifying you so that you may take steps to protect yourself.

3. What We Are Doing.
   • Secured the affected environment and implemented enhanced monitoring and multi-factor authentication.
   • Engaged leading cybersecurity and data-privacy counsel to assist with the investigation.
   • Notified law-enforcement and are cooperating fully.
   • Arranged for complimentary [12/24/36]-month credit monitoring and identity-theft protection services through [VENDOR NAME]. Activation instructions appear in Section 5 below.

4. What You Can Do.
   • Review the “Steps You Can Take to Protect Your Information” in Section 6.
   • Remain vigilant by monitoring your account statements and credit reports.
   • Place a fraud alert or security freeze on your credit file, if appropriate.

5. Complimentary Credit Monitoring.
   • Enrollment Code: [UNIQUE CODE]
   • Sign-Up Deadline: [MM/DD/YYYY]
   • Enroll at: [URL] or call [PHONE] for assistance.

6. Steps You Can Take to Protect Your Information.
   a. Order Free Credit Reports. Under federal law, you are entitled to one free report annually from each of the three major credit bureaus at www.annualcreditreport.com or 1-877-322-8228.
   b. Fraud Alerts. Contact any one bureau to place a 1-year fraud alert on your credit file.
   c. Security Freezes. You may place a freeze at no cost. Contact information for the bureaus is provided below:

• Equifax – www.equifax.com | 1-800-349-9960
• Experian – www.experian.com | 1-888-397-3742
• TransUnion – www.transunion.com | 1-888-909-8872

d. Additional Resources. Visit the FTC at www.identitytheft.gov or call 1-877-438-4338.

7. For More Information.
   If you have any questions, please contact our dedicated call center at [TOLL-FREE NUMBER] (Monday–Friday, 6 a.m.–6 p.m. HST) or email [SUPPORT EMAIL].

We regret any inconvenience or concern this incident may cause. Protecting your information remains our highest priority.

Sincerely,

[NAME OF AUTHORIZED SIGNATORY]
[TITLE]
[COMPANY LEGAL NAME]

5. EXECUTION BLOCK

Company authorizes the foregoing notices as of the Notice Date.

[// GUIDANCE:
1. Notarization is not required for Hawaiʻi data-breach letters.
2. Retain proof of mailing/emailing and all internal documentation for a minimum of five (5) years to satisfy Haw. Rev. Stat. § 487N-2(f).
3. If ≥ 1,000 individuals are notified, remember simultaneous notice to the nationwide consumer-reporting agencies under § 487N-2(d).]

© [YEAR] – Prepared by Counsel. This template is provided for general informational purposes and does not constitute legal advice. Customization and attorney review are required before use.