Law / United States / 
Hawaii
Hawaii Security Breach of Personal Information Act, notice of security breach
Haw. Rev. Stat. Secs. 487N-1, 487N-2
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
What follows is LexLint's own research summary of this law, not legal advice.
Commencement not set.
A breach notification rule binding public and private bodies.
As of 27 August 2026.
What it requires
- Provide clear and conspicuous notice, without unreasonable delay, to a Hawaii resident affected by a security breach of a system containing their personal information, describing the incident, the type of information exposed, and remedial steps taken.
- Notify the State of Hawaii's Office of Consumer Protection and nationwide consumer reporting agencies if the breach requires notifying more than 1,000 persons at one time.
- Do not rely on this statute to cover a breach of biometric, genetic, or health data alone. Hawaii's personal information definition does not include any of those categories.
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
A business that owns or licenses personal information of Hawaii residents, a business conducting business in Hawaii that owns or licenses such information, and a government agency that collects personal information for government purposes must each provide notice, without unreasonable delay, to a person affected by a security breach.
Notice must be clear and conspicuous, describe the incident and the type of personal information exposed, describe remedial steps taken, give a contact number, and advise the recipient to monitor credit reports; substitute notice is available above a $100,000 cost or 200,000-person threshold. Above a 1,000-person notice threshold, the business must also notify the State of Hawaii's Office of Consumer Protection and nationwide consumer reporting agencies.
Hawaii's personal information definition covers only a name combined with a Social Security number, driver's license or state ID number, or a financial account number with an access code or password, excludes information lawfully made public through federal, state, or local government records, and has no biometric, genetic, or health category, so a breach of biometric data alone triggers no notice duty.
When LexLint raises it
crawls_webtrains_modelsdeploys_chatbotautomated_outreach
Read the law
official Hawaii Revised Statutes text, Hawaii State Legislature
Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.