← All US breach laws·HI

Hawaii data breach notification law

Hawaii's data breach notification requirements under Haw. Rev. Stat. §§487N-1 to 487N-7. Below: the resident-notification deadline, AG/regulator filing threshold, the encryption safe harbor, private right of action exposure, penalty schedule, and the common pitfalls that turn an avoidable incident into a regulator enforcement action.

Statute
Haw. Rev. Stat. §§487N-1 to 487N-7
Enforcer
Hawaii Office of Consumer Protection
AG notification
Required
Private right of action
Yes — residents can sue

Notification deadlines

Notify affected residents
Without unreasonable delay
Notify the state regulator
Yes — if more than 1,000 Hawaii residents are affected, written notice to the Office of Consumer Protection
Notify consumer reporting agencies
Yes — if more than 1,000 residents, notify nationwide CRAs

When is notification required?

Trigger / harm threshold
Notification required when there is a material risk of identity theft or other fraud
Encryption safe harbor
Yes — properly encrypted personal information is generally exempt from notification, provided the encryption key was not also compromised.

What counts as "personal information" under Hawaii law

First name/initial + last name with SSN, DL/HI ID, account number/credit/debit + access code

Penalties and enforcement

Up to $2,500 per violation; private right of action for actual damages
Enforced by: Hawaii Office of Consumer Protection. Official regulator page →

Common pitfalls

⚠ Hawaii's PI definition is narrower than most — does NOT explicitly include health, biometric, or credential data

Frequently asked questions

How long do I have to notify Hawaii residents after a data breach?
Without unreasonable delay
Do I have to notify the Hawaii Attorney General?
Yes — if more than 1,000 Hawaii residents are affected, written notice to the Office of Consumer Protection
Does Hawaii require notification to nationwide consumer reporting agencies?
Yes — if more than 1,000 residents, notify nationwide CRAs
Is encrypted data exempt from Hawaii's breach notification requirement?
Yes — Hawaii has an encryption safe harbor. Breaches of properly encrypted personal information generally do not trigger notification, provided the encryption key was not also compromised.
Can Hawaii residents sue me directly for a data breach?
Yes — Hawaii allows a private right of action. Affected residents may sue for actual damages and, in some cases, statutory damages or attorneys' fees. Class actions are common.
What counts as 'personal information' under Hawaii law?
First name/initial + last name with SSN, DL/HI ID, account number/credit/debit + access code
What are the penalties for failing to comply with Hawaii's breach notification law?
Up to $2,500 per violation; private right of action for actual damages

Related state breach laws

Florida (FL)
Fla. Stat. §501.171
Georgia (GA)
Ga. Code §§10-1-910 to 10-1-915
Idaho (ID)
Idaho Code §§28-51-104 to 28-51-107
Illinois (IL)
815 ILCS 530/1 et seq.

Pre-empt the Hawaii breach notice — audit your policy now

ComplianceIQ runs a free audit of your privacy policy and incident-response language against Hawaii's statutory requirements. You'll see every gap before you have to use it for real.

Run free policy audit