The Regulator may institute a civil action for damages against a business for a data breach. Whether or not there is intent or negligence.
What is a data breach?
A data breach can be explained as the intentional or unintentional release of secure or private confidential information to any unauthorised person.
A court issuing any order for damages must also order that such breach published in the gazette. Therefore, it will tarnish the reputation of the business.