HRS §431:3B-201
Creating a written plan to protect private information
This section requires a licensee to create, use, and keep a written security plan. The plan must fit the licensee's size, activities, and how sensitive the private information is. It must include safeguards for that information and its computer systems.
businesses
The statute, as written — Implementation of an information security program
Commensurate with the size and complexity of the licensee, the nature and scope of the licensee's activities, including its use of third-party service providers, and the sensitivity of the nonpublic information used by the licensee or in the licensee's possession, custody, or control, each licensee shall develop, implement, and maintain a comprehensive written information security program based on the licensee's risk assessment and that contains administrative, technical, and physical safeguards for the protection of nonpublic information and the licensee's information system.
LawTrove is not legal advice. The summary above is a computer-generated restatement — the authoritative text is the official version linked above.