The Hawaii rule in full No fixed deadline
Haw. Rev. Stat. §§ 487N-1 to 487N-4
- Notify residents
- Without unreasonable delay after discovering or being notified of the breach. The business may allow time to find contact information, determine the scope of the breach and restore the system.
- Notify the state
- Notify the Office of Consumer Protection in writing, without unreasonable delay, of the timing, distribution and content of the notice, if the business notifies more than 1,000 persons at one time.
- Credit bureaus
- More than 1,000 residents notified.
- No-harm exception
- Notice is required only if illegal use of the personal information has occurred or is reasonably likely to occur and that creates a risk of harm to a person. Otherwise the event is not a security breach.
- Encryption
- Encrypted data is exempt unless the confidential process or key was also acquired.
- Data covered beyond the basic set
- Account number alone.
- Enforcement
- The Attorney General or the executive director of the Office of Consumer Protection may sue. The penalty is up to $2,500 for each violation.
- Also know
- Covers personal information in any form, including paper. An account number, card number, access code or password counts on its own if it would permit access to a financial account. Vendors must tell the owner immediately. Financial institutions following federal interagency guidance and HIPAA covered health plans and providers are treated as compliant. Bills SB 3016 and SB 1038 to expand covered data were not enacted in 2026.
Law: Haw. Rev. Stat. §§ 487N-1 to 487N-4 | HRS § 487N-1 Definitions | HRS § 487N-3 Penalties and civil action. Read from the statute and checked by a second reviewer on October 13, 2026. Compare all states.
Other West Coast and Pacific states: California, Alaska. A breach that reaches their residents brings in their rules too.
Dealing with a breach right now? Two short steps. A security provider follows up by email within one business day.
Get a quote for my businessWhat the Hawaii data breach notification law treats as a breach
Hawaii treats an incident as a breach only when illegal use of the information has occurred or is reasonably likely, and that use creates a risk of harm to a person 2. Encrypted data is exempt unless the confidential process or key was also acquired 2.
The law covers personal information in any form, paper included 2. A lost folder of employee records with Social Security numbers can count, not just a hacked server, so locked cabinets and shredding belong in the same plan as firewalls and backups.
The timing standard is without unreasonable delay, and Hawaii spells out what counts as reasonable time: tracking down addresses, measuring how far the breach went, and getting systems running again 1. With no day count to point to, a dated log of each step is your best defense.
The Office of Consumer Protection, not the Attorney General
Hawaii's state-level notice skips the Attorney General. It goes to the Office of Consumer Protection, which must get a written description of when the letters went out, how they were delivered and what they said once more than 1,000 persons are notified at one time 1. Cross that same line and the credit bureaus need notice too 1.
If a cloud host, billing service or other vendor loses records it keeps for you, it has to tell you immediately after discovering it 1.
Banks that follow the federal interagency guidance, and HIPAA-covered health plans and providers, are treated as compliant when they follow those federal rules 1. A medical or dental office can see what that involves in our HIPAA notice explainer.
Want a second opinion on your setup? Send a short request and one provider follows up by email within one business day. How it works.
Get a quote for my businessAccount numbers, penalties and pending bills
Hawaii lists an account number, credit or debit card number, access code or password that would permit access to a financial account as one data element, with no added code required 2. On a plain reading, an account number with nothing else attached can be enough. Several published charts say a code is also needed; do not lean on that narrower version without a lawyer's view.
The Attorney General or the executive director of the Office of Consumer Protection may sue for violations, with a penalty of up to $2,500 for each violation 3. People harmed by a violation can also file their own civil suit 3.
A 2026 bill to expand the data the law covers, SB 3016, was not enacted 4. A similar bill carried over from 2025, SB 1038, showed no enactment when we checked.
Handling a breach in Hawaii
If the intruder is still active, an insured Hawaii business calls its carrier's claims line ahead of everyone else, puts the FBI on notice via ic3.gov, and leaves the affected computers alone so evidence survives 576. Print the carrier's number now; on the bad day email may not work. How cyber policies set conditions covers what the carrier will expect.
Then a containment specialist or your own IT support shuts the intruder out, following the order in our breach response checklist. Count filing cabinets and boxes along with servers. Visitors and mainland customers carry their home states' rules, so record where each person lives: California, for example, sets a 30-day deadline. Each other state appears in our state breach law comparison, and managed IT in Honolulu covers local support pricing.
HRS chapter 487N, as read on October 13, 2026, is what this page reflects. A plain-English summary cannot serve as legal advice; confirm your own obligations with a Hawaii lawyer.
Common questions
Does the Hawaii data breach notification law set a deadline?
Not in days. The standard is without unreasonable delay, allowing time to locate people, size up the breach and restore systems 1.
Who do you notify in Hawaii besides affected people?
Past 1,000 people in one mailing, the Office of Consumer Protection gets a written description of the mailing and the credit bureaus get notice 1.
Does Hawaii's breach law cover paper records?
Yes. A lost box of printed files counts the same as a hacked database 2.
What is the penalty for violating Hawaii's breach law?
As much as $2,500 per violation when the Attorney General or the Office of Consumer Protection sues 3. Harmed individuals have their own civil claim.
Is encrypted data exempt in Hawaii?
It is, provided the thief did not also get the key or confidential process that reads it 2.
Sources
- Hawaii State Legislature, Haw. Rev. Stat. §§ 487N-1 to 487N-4 (HRS § 487N-2 Notice of security breach), 2026.
- Hawaii State Legislature, HRS § 487N-1 Definitions, 2026.
- Hawaii State Legislature, HRS § 487N-3 Penalties and civil action, 2026.
- BillTrack50, HI SB3016 (2026) status, 2026.
- Federal Trade Commission, Data Breach Response: A Guide for Business, 2025-06-20.
- FBI, Ransomware, 2026-04-08.
- Federal Trade Commission, Cyber Insurance, 2021-11-09.
Updated October 13, 2026.