LexLint

Know the law where your app runs.

Law / United States / Hawaii

Destruction of Personal Information Records

Haw. Rev. Stat. Secs. 487R-1 to 487R-3

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

In force since 1 January 2007.

A security baseline statutes rule binding public and private bodies.

As of 15 September 2026.

What it requires

  • This binds any business or government agency that conducts business in Hawaii, or that maintains or otherwise possesses personal information of a Hawaii resident.
  • Take reasonable measures to protect against unauthorized access to or use of personal information in connection with or after its disposal.
  • Implement and monitor compliance with policies and procedures that require papers containing personal information to be burned, pulverized, recycled, or shredded, and electronic or other nonpaper media containing personal information to be destroyed or erased, so the information cannot practicably be read or reconstructed.
  • Describe the adequate destruction or proper disposal of personal records as official policy in the business's own writings.
  • Where a records-destruction vendor is contracted to destroy personal information, satisfy this duty by exercising due diligence: reviewing an independent audit of the vendor's operations or compliance, obtaining reliable information about the vendor or requiring the vendor be certified by a recognized trade association, or reviewing and evaluating the vendor's information security policies and procedures.
  • This chapter does not apply to a financial institution subject to the Gramm-Leach-Bliley Act (15 U.S.C. 6801 to 6809), a health plan or health care provider subject to and compliant with the HIPAA privacy and security standards, or a consumer reporting agency subject to and compliant with the Fair Credit Reporting Act.

If you get it wrong

Criminal exposureNo

Private right of actionYes

Penalty structure

Ceiling stated as 'not more than $2,500 for each violation' with no aggregate cap named; brought by the attorney general or the executive director of the office of consumer protection, and never against a government agency.

Rule
Per violation only
As of
15 September 2026
Currency
USD
Per violation unit
Violation
Per violation amount
2,500

Who enforces it

Enforcement body

Hawaii Attorney General or the executive director of the Hawaii Office of Consumer Protection

What it reaches

Obligation class

Security, Retention

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Haw. Rev. Stat. ch. 487R, effective January 1, 2007 (Act 136, 2006 Regular Session, SB2292 SD2 HD1 CD1), requires any business or government agency that conducts business in Hawaii, or that maintains or otherwise possesses a Hawaii resident's personal information, to take reasonable measures to protect against unauthorized access to or use of that personal information in connection with or after its disposal.

The duty is satisfied by burning, pulverizing, recycling or shredding paper records and destroying or erasing electronic and other nonpaper media so the information cannot practicably be read or reconstructed, or by exercising due diligence over a contracted records-destruction vendor. A financial institution subject to the Gramm-Leach-Bliley Act, a HIPAA-compliant health plan or health care provider, and a Fair Credit Reporting Act-compliant consumer reporting agency are exempt.

A violating business is subject to a civil penalty of not more than $2,500 per violation, brought by the attorney general or the executive director of the office of consumer protection, and is separately liable to the injured party for actual damages and, at the court's discretion, reasonable attorneys' fees. No action under the chapter may be brought against a government agency, which instead must report a material breach of disposed records to the legislature under section 487R-4.

When LexLint raises it

  • crawls_web
  • trains_models
  • deploys_chatbot
  • automated_outreach
  • high_risk_decisions
  • processes_voice
  • processes_biometrics
  • serves_minors
  • operates_social_platform
  • ships_mobile_app
  • distributes_software_product

Read the law

official Hawaii Revised Statutes text, Hawaii State Legislature

Back to the example  ·  Lint your app