1. Home
  2. State breach laws
  3. Hawaii

Hawaii data breach notification law

What Hawaii requires when personal information is exposed: how fast residents must be notified, when the Attorney General has to be told, what it costs to get it wrong, and whether affected people can sue. Governed by Haw. Rev. Stat. §§ 487N-1 to 487N-7.

No fixed deadline
Notification deadline
Not required
AG notification
Yes
Private right of action
None
Liability protection

What this means if you sell security services

Hawaii sets no fixed deadline, only "without unreasonable delay," so filings can land weeks after discovery, often after the organization has finished its first response and started asking what to do differently. There is no Attorney General notice requirement, so Hawaii incidents surface mainly through SEC and HHS filings and through other states' records, channels fewer competitors watch. A private right of action adds lawsuit exposure on top of regulatory cost, which makes incident-readiness, documented controls, and evidence-quality logging an easy conversation.

See recent Hawaii breach filings →

Requirements in detail

Statute
Haw. Rev. Stat. §§ 487N-1 to 487N-7
Deadline to notify residents
Without unreasonable delay after discovering or being told of the breach, consistent with law enforcement needs and the steps needed to find contact information, determine the scope, and restore the system. A written or documented law enforcement request can delay notice.
Attorney General notification
No Attorney General notice is required. A business that notifies more than 1,000 people at one time must notify, in writing and without unreasonable delay, the State Office of Consumer Protection and all nationwide consumer reporting agencies about the timing, distribution, and content of the notice.
Penalties
Penalties of up to $2,500 per violation, enforced by the Attorney General or the executive director of the Office of Consumer Protection. A business is also liable to injured people for their actual damages, and the court may award reasonable attorney's fees to the prevailing party.
Private right of action
Yes. Affected individuals can bring a private lawsuit under the breach notification law.
Encryption exemption
Hawaii's notification requirements apply to unencrypted personal information. Encrypted data generally doesn't trigger notice unless the encryption key or credentials were also compromised.
Liability protection for security programs
None. Hawaii has no law limiting breach lawsuits for organizations that maintain a security program.

Hawaii breach notification FAQ

What is the data breach notification deadline in Hawaii?

Without unreasonable delay after discovering or being told of the breach, consistent with law enforcement needs and the steps needed to find contact information, determine the scope, and restore the system. A written or documented law enforcement request can delay notice. The governing law is Haw. Rev. Stat. §§ 487N-1 to 487N-7.

Does Hawaii require notifying the Attorney General of a data breach?

No Attorney General notice is required. A business that notifies more than 1,000 people at one time must notify, in writing and without unreasonable delay, the State Office of Consumer Protection and all nationwide consumer reporting agencies about the timing, distribution, and content of the notice.

What are the penalties for failing to report a data breach in Hawaii?

Penalties of up to $2,500 per violation, enforced by the Attorney General or the executive director of the Office of Consumer Protection. A business is also liable to injured people for their actual damages, and the court may award reasonable attorney's fees to the prevailing party.

Can individuals sue over a data breach in Hawaii?

Yes. Affected individuals can bring a private lawsuit under the breach notification law.

Does encrypted data need to be reported in Hawaii?

Hawaii's notification requirements apply to unencrypted personal information. Encrypted data generally doesn't trigger notice unless the encryption key or credentials were also compromised.

Does Hawaii limit breach lawsuits for companies with a cybersecurity program?

No. Hawaii has no law limiting breach lawsuits for organizations that maintain a security program.

Last reviewed October 5, 2026. This summary is for general information and is not legal advice. Statutes change; confirm current requirements with counsel or the Hawaii Attorney General before relying on them.

Other states with a no fixed deadline

Breach notification laws by state

Compare all 51 jurisdictions on the interactive map →·US data breach statistics →