A Data Breach
HRS 487N-2 — notice without unreasonable delay, and actual damages for a business that fails
A business or government agency with Hawaii residents' personal information gives notice to each affected person after discovering a security breach, without unreasonable delay. Personal information is a name with a social security number, driver's license or state ID number, or financial account or card number with its access code, where not encrypted.
Who handles this in Hawaii: Office of Consumer Protection; and legal aid programs, lawyer referral and the state offices, listed in the Hawaii directory.
- The notice describes the incident, the kind of information involved, what the business did to protect it, a phone number for help if there is one, and a reminder to watch account statements and credit reports.
- It may be delayed at a law enforcement agency's written request while it would impede an investigation.
- A business notifying more than one thousand people at once also notifies the office of consumer protection and the national credit reporting agencies.
A business that violates the chapter is liable to the injured person for actual damages, and the court may award attorney's fees to the winning side. The State may also seek penalties of up to $2,500 per violation.
Sources for this section (3)
- HRS 487N-2 — Notice of security breach
- HRS 487N-1 — Definitions
- HRS 487N-3 — Penalties; civil action
Legal information, not legal advice. Verified as of October 2026. Applying it to a particular situation is the work of a licensed Hawaii attorney.