Data breach notification
Hawaii's breach rules are in Haw. Rev. Stat. chapter 487N, Security Breach of Personal Information, with notice in § 487N-2 and definitions in § 487N-1.
Section 487N-2 reaches any business that conducts business in Hawaii and owns or licenses personal information in any form, whether computerized, paper or otherwise.
A filing cabinet left open or a box of printed statements is inside the rule just as a database is.
Personal information is an individual's first name or first initial and last name with one or more of three data elements, when either the name or the data elements are not encrypted.
A security breach, in Hawaii's terms, includes a harm element: it exists where illegal use of the personal information has occurred, or is reasonably likely to occur, and that creates a risk of harm to a person.
Encrypted records are not wholly outside the rule: unauthorized access to and acquisition of encrypted records along with the confidential process or key is a security breach.
Individuals are to be told without unreasonable delay; the section uses the words "The disclosure notification shall be made without unreasonable delay." Hawaii names no number of days.
When a business provides notice to more than one thousand persons at one time, it must notify in writing, without unreasonable delay, the State of Hawaii's Office of Consumer Protection. The nationwide consumer reporting agencies are also to be told at that size.
The office named for that letter is the Office of Consumer Protection, which is worth knowing before drafting it.
For documents you share through ShareAndGo, the activity log records every view and download, and watermarked view-only pages carry the reader's email address and the date.
That watermark is a room-level setting, on by default. Recipients confirm their email with a six-digit code and need no account, so no reader is anonymous. Groups only see their own folders. When a business wants to know which of its shared files a particular person opened, and on which day, the chained log answers it, and the CSV export can go straight into an incident file.
Checked against Hawaii's published law on November 2, 2026. This is general information, not legal advice.
