The laws that should govern the handling of misappropriated information are still frozen in the clauses of the Data Protection Act that have not been brought into local legislation.
You need to make an investment that’s suitable to the proportion of risk that you face.
