LexLint

Know the law your code answers to.

Law / United States / Hawaii

Hawaii Security Breach of Personal Information Act, penalties and civil action

Haw. Rev. Stat. Sec. 487N-3

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

Commencement not set.

An enforcement supervision rule binding private bodies.

As of 2 September 2026.

What it requires

  • Expect a Hawaii resident injured by a business's violation of this Act to have a private right of action for actual damages plus attorneys' fees, on top of a state penalty of up to $2,500 per violation.
  • Do not assume government-agency status shields a private violator from suit. The exemption from private and state enforcement action runs to government agencies only, not to a private business handling data on a government agency's behalf.

If you get it wrong

Criminal exposureNo

Private right of actionYes

Penalty structure

This civil penalty, sought by the Attorney General or the executive director of the Office of Consumer Protection, is separate from the actual damages available to an injured party under Haw. Rev. Stat. Sec. 487N-3(b).

Rule
Per violation only
As of
2 September 2026
Currency
USD
Per violation unit
Violation
Per violation amount
2,500

Who enforces it

Enforcement body

Hawaii Attorney General or the executive director of the Office of Consumer Protection (Haw. Rev. Stat. Sec. 487N-3(a)).

What it reaches

Obligation class

Breach notice

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

A business that violates any provision of the Security Breach of Personal Information Act is subject to a penalty of not more than $2,500 per violation, brought by the Attorney General or the executive director of the Office of Consumer Protection. Separately and additionally, a violating business is liable to the injured party for actual damages sustained as a result of the violation, and the court may award reasonable attorneys' fees to the prevailing party.

No action under either route may be brought against a government agency, so the private right of action and the state enforcement action both reach only private businesses despite the notice duty itself extending to government agencies.

When LexLint raises it

  • crawls_web
  • trains_models
  • deploys_chatbot
  • automated_outreach

Read the law

official Hawaii Revised Statutes text, Hawaii State Legislature

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example  ·  Lint your app