“We reminded them of their duty to report any breach in data security to us. The report they sent us was very general and certainly did not meet the legal requirements,” said Tlakula.
The regulator was created by the Protection of Personal Information Act to hold organisations that process personal information accountable. But the department merely informed the regulator that its computer systems had been hacked.