Data Privacy Compliance in Hawaii: Breach Notification Law and Encryption Basics

Editor's note: We have rebranded: Intech Hawaii is now Intech Pacific. We updated this post in October 2026 and combined several earlier articles on this topic into one guide.

Last updated: October 2026

Data privacy compliance in Hawaii rests on a state breach notification law, a state data disposal law, and federal rules that depend on your industry. As of October 2026, Hawaii does not have a comprehensive consumer privacy law like California's, so most businesses here are governed by HRS Chapter 487N plus HIPAA, GLBA, PCI DSS, or other sector requirements.

Encryption sits at the center of all of it. Under Hawaii's breach law, properly encrypted personal information is treated differently from readable data, and the same idea appears in federal health and financial rules. This guide explains which laws apply, what Hawaii requires after a breach, and how to encrypt data in a way that will hold up to an auditor, an insurer, or a regulator.

Which Data Privacy Laws Apply to Hawaii Businesses?

Hawaii businesses are covered by state laws on breach notification and record disposal, and by federal laws tied to the type of data they handle. As of October 2026, Hawaii has not enacted a comprehensive consumer data privacy act.

That point needs to be clear, because an earlier version of this post described a "Hawaii Consumer Data Protection Act" as if it were in effect. It is not. Lawmakers have introduced privacy bills in recent sessions, including a 2026 data broker bill called the Hawaii Drop and Delete Act (HB 2463). A 2026 bill to expand the definition of personal information in the breach law did not get a final hearing before the session ended. None of these proposals had become law as of October 2026.

Here is what does apply to most Hawaii organizations today:

• HRS Chapter 487N (security breach notification). Applies to businesses that own or license personal information of Hawaii residents, and to government agencies.
• HRS Chapter 487R (destruction of personal information records). Requires reasonable measures to protect personal information when it is disposed of. We cover disposal in our guide to secure e-waste and data disposal.
• HIPAA, for covered entities and business associates handling protected health information. See our guide on what HIPAA compliance means.
• GLBA, which reaches banks and credit unions through their regulators and many non-bank financial businesses through the FTC Safeguards Rule.
• PCI DSS, a contractual standard for any business that accepts payment cards.
• Other states' laws, which may apply if you collect data from residents of states that have comprehensive privacy laws and you meet their thresholds.

Most businesses I work with fall under more than one of these. Crosswalking frameworks takes experience, because the same control (encryption, access review, incident response) shows up in each one with slightly different wording.

What Does Hawaii's Breach Notification Law (HRS 487N) Require?

Hawaii's breach notification law requires a business that experiences a security breach involving Hawaii residents' personal information to notify affected people without unreasonable delay. If more than 1,000 people are notified at one time, the business must also notify the State Office of Consumer Protection and the nationwide consumer reporting agencies.

What Counts as Personal Information

Under HRS 487N-1, personal information means a person's first name or first initial and last name combined with any of the following, when either the name or the data element is not encrypted:

• A Social Security number.
• A driver's license number or Hawaii identification card number.
• An account number, credit card number, or debit card number combined with any access code or password that would allow access to a financial account.

Encryption Changes the Analysis

A security breach under the statute is unauthorized access to and acquisition of unencrypted or unredacted records. Encrypted records only count as a breach if the attacker also obtained the confidential process or key. That is why key management matters as much as the encryption itself.

What the Notice Must Include

Under HRS 487N-2, the notice must be clear and conspicuous and must describe:

1. The incident in general terms.
2. The type of personal information involved.
3. What the business has done to protect the data from further unauthorized access.
4. A telephone number for more information, if one exists.
5. Advice to remain vigilant by reviewing account statements and monitoring free credit reports.

Notice can be delayed if law enforcement requests it in writing, or if the request is documented at the time it is made. A vendor that maintains data for another business must notify the data owner immediately after discovering a breach.

Financial institutions that follow the federal interagency response guidance or 12 CFR Part 748, and health plans and providers that comply with HIPAA, are deemed compliant with the Hawaii notice section. The Office of Consumer Protection publishes a list of reported breaches affecting Hawaii residents, which lists hacking and stolen laptops or equipment among the most frequent causes. Stolen equipment is exactly the scenario where encryption does its best work.

Why Encryption Matters for Compliance in Hawaii

Encryption is the control that most often turns a reportable breach into a non-event. Hawaii's breach law, HHS breach guidance under HIPAA, and the FTC Safeguards Rule all treat properly encrypted data differently from readable data.

• HHS guidance says protected health information is "secured" when it is encrypted consistent with NIST guidance referenced by HHS and the key has not been compromised. Under the current Security Rule, encryption is an addressable specification. The HIPAA Security Rule changes HHS proposed in January 2025 would make encryption required, but as of October 2026 that proposal is not final.
• FTC Safeguards Rule. Covered non-bank financial businesses must encrypt all customer information held or transmitted, in transit and at rest. If that is infeasible, a Qualified Individual must approve compensating controls.
• Cyber insurance. Applications ask about encryption on laptops, backups, and email. They get longer every year, and there is no shortcut: the controls have to be in place.

I tell clients that compliance and security are not opposites. A framework exists because it works. Following one makes you more secure, and there is very little downside to doing so.

Data Encryption 101: How Encryption Works

Encryption uses an algorithm and a key to turn readable data (plaintext) into unreadable data (ciphertext). Only someone with the correct key can turn the ciphertext back into plaintext.

Data at Rest and Data in Transit

• Data at rest is stored data: laptop drives, servers, databases, backups, and USB drives. Full-disk encryption tools such as BitLocker on Windows and FileVault on macOS protect it if a device is lost or stolen.
• Data in transit is data moving across a network: web traffic, email, file transfers, and remote access. TLS (the protocol behind HTTPS) and VPNs protect it.
• End-to-end encryption means data is encrypted on the sender's device and only decrypted on the recipient's device, so servers in between cannot read it. Full-disk encryption on a phone is not end-to-end encryption; it protects data at rest on that phone.

Symmetric and Asymmetric Encryption

• Symmetric encryption uses one shared secret key to encrypt and decrypt. AES is the standard choice, with 128, 192, or 256-bit keys. It is fast and used for most stored data.
• Asymmetric encryption uses a key pair. Anyone can encrypt with the public key, and only the holder of the private key can decrypt. RSA and elliptic curve cryptography (ECC) are common examples. Asymmetric encryption is typically used to exchange symmetric keys and to create digital signatures.

Older algorithms such as DES and 3DES should be retired. Encryption by itself keeps data confidential, but it does not prove data was not altered. Modern protocols use authenticated encryption or separate integrity checks for that.

Plan for Post-Quantum Cryptography

NIST finalized its first three post-quantum encryption standards (FIPS 203, 204, and 205) in August 2024 and urged organizations to begin the transition. For most small businesses, the practical step today is an inventory of where RSA and ECC are used, so vendor upgrades can be tracked.

When Do You Need FIPS-Validated Encryption?

FIPS-validated encryption means the cryptographic module has been tested and certified under NIST's Cryptographic Module Validation Program. It is required for federal systems and federal contractors handling controlled data, and it is referenced in HHS guidance for data in transit.

A product that "uses AES" is not automatically FIPS validated. The specific module and version must appear in the NIST validated modules database, and it often has to run in a FIPS-approved mode.

One date matters for anyone relying on older certificates. Under NIST's FIPS 140-3 transition schedule, all FIPS 140-2 certificates move to the historical list in September 2026. Historical modules should not be used in new systems. If your compliance obligations call for FIPS validation, check your certificates and plan upgrades to FIPS 140-3 validated modules.

Encryption Best Practices Checklist for Hawaii Businesses

Use this checklist to move from "we think we encrypt" to "we can prove it":

1. Inventory your sensitive data. Know where Social Security numbers, account numbers, health records, and payment data live, including copies in email and file shares.
2. Turn on full-disk encryption for every laptop and desktop, and confirm it with reporting from your management tools, not assumptions.
3. Encrypt backups, and keep at least one copy offline or immutable.
4. Require TLS for websites, portals, and email transport, and disable outdated protocol versions.
5. Use a secure portal or message encryption for sending sensitive documents, not ordinary attachments.
6. Encrypt mobile devices and removable media through device management, and block unencrypted USB drives where practical.
7. Store keys separately from the data, limit who can access them, require MFA for key administration, and rotate keys on a defined schedule.
8. Never keep keys or passwords in unencrypted files or shared documents.
9. Verify FIPS validation where your contracts or regulations call for it.
10. Document all of it in your information security plan, including exceptions and who approved them.

How to Build a Privacy Program That Holds Up

A privacy program is more than a privacy policy on your website. It is a set of decisions about what data you collect, why, how long you keep it, and how you protect and dispose of it.

The FTC's guide to protecting personal information organizes this into five steps: take stock, scale down, lock it, pitch it, and plan ahead. Those steps translate well for any Hawaii business:

• Collect less. Data you never collect cannot be breached. Stop collecting Social Security numbers where you do not need them.
• Keep it for less time. Set retention periods and follow them.
• Limit access. Give staff access only to the data their role requires.
• Train your people. Security awareness training is the single most effective control I know for a small business.
• Plan your response. Know who will decide whether an incident is a breach under HRS 487N and who will send the notices.

The document most businesses are missing when an auditor or insurer asks is an information security plan. Either it does not exist, or it is a generic template that does not describe the actual environment. A plan that matches how you really operate is a core part of risk management in Honolulu and everywhere else.

One more lesson from my career: IT work can be delegated to a trusted, funded team with regular check-ins. Compliance cannot. Leadership has to drive it, or it fails. With HIPAA in particular, organizations often underestimate the effort. You cannot buy compliance. It takes the whole organization.

Talk to Intech Pacific About Data Privacy Compliance

Intech Pacific helps Hawaii businesses map their obligations under HRS 487N, HIPAA, GLBA, and PCI DSS, put the right encryption and cybersecurity controls in place, and document them so they hold up to review. If you are not sure which rules apply to you, we can start with a conversation. Learn more about our IT compliance services for Hawaii organizations.