Privacy Map

Hawaii. Breach notification. Act

HI breach lawHawaii data breach notification law (Haw. Rev. Stat. § 487N-1 et seq.)

In force
Partly verifiedMedium confidence. Narrow PI definition; 2008 is latest amendment identified.

§1Summary

Synopsis

Requires businesses (and in most cases public bodies) that own or license computerised personal information about Hawaii residents to notify affected individuals after a security breach. Core timing rule: Individuals without unreasonable delay. Covered data: name plus SSN, driver's licence/ID, financial account numbers or access codes.

Key themes
  • breach notification
  • personal information definition
  • regulator notice
  • consumer reporting agency notice
  • vendor-to-owner notice
  • encryption safe harbour
  • substitute notice
  • law enforcement delay
Unique features

Regulator notice goes to the consumer protection office rather than the AG; also covers paper records.

SaaS relevance

A SaaS provider hosting customer data is usually the 'maintaining' entity, not the owner: Hawaii requires the maintaining business to notify the owner immediately after discovery. The owner customer then carries the individual and regulator notices, so contracts should fix timelines and cooperation.

§2Obligations

Extraterritorial
Limited
Breach notification
Individuals without unreasonable delay; Office of Consumer Protection and CRAs if >1,000 notified at one time
DPO
No
Cross-border transfers
None
Maximum penalty
Up to $2,500 per violation; private action for damages

§3Dates

Key dates
  • Adopted
  • In force
  • Amended by Act 19 (2008)

§4Text and authority

Text
Authority
Hawaii Office of Consumer Protection (DCCA)

§5Where it applies

Domestic law of
Hawaii

§6Sources and verification

Sources consulted
Verification

Medium confidence.

Partly verifiedMedium confidence. Narrow PI definition; 2008 is latest amendment identified.