Data Breach Notification Statutes – Hawaii

Last Updated: 02/28/2024

• Applicable Statute: HRS § 487N-1 et seq.
• Attorney General Notice Required: Yes– If notice is provided to more than 1,000 residents. the entity must notify in writing, without unreasonable delay, the Hawaii Office of Consumer Protection of the timing, distribution, and content of the notice.
  • Timing : Without unreasonable delay
  • Method: In writing to Hawaii Office of Consumer Protection
  • Content : Include details on the timing, distribution, and content of the consumer notices.
• Consumer Notice Requirements:
  • Timing: Without reasonable delay following discovery or notification of the breach, consistent with any measures necessary to determine sufficient contact information, the scope of the breach, and to restore the reasonable integrity, security, and confidentiality of the system.
  • Content: Notice must be clear and conspicuous and include a description of:
    • The incident in general terms;
    • The type of personal information subject to the access and acquisition;
    • The subject entity’s general acts to protect the personal information from further unauthorized access;
    • A telephone number that the person may call for further information and assistance, if one exists; and
    • Advice that directs the person to remain vigilant by reviewing account statements and monitoring free credit reports.
  • Method: By written notice to the last available address on record; email if the subject entity has a valid email address, and the individual agreed to receive communications electronically, and if the notice is in compliance with E-SIGN Act; or telephonic notice, provided that contact is made directly with the affected persons. Substitute notice may be available under certain conditions.
• Consumer Reporting Agency Obligations: If more than 1,000 residents are notified, notice must be given without unreasonable delay to all nationwide consumer reporting agencies.