| (1) | The competent authority may disclose confidential information obtained in terms of these Regulations if: |
| (a) | the information is disclosed in compliance with the provisions of any law of the Republic of South Africa; |
| (b) | the person is ordered to disclose the information by a court of law of the Republic of South Africa; or |
| (c) | the information is disclosed for the purposes of the administration of justice. |
[Regulation 12(1)(a)(b) substituted by regulation 12 of Notice No. R994, GG43712, dated 11 September 2020]
| (2) | The competent authority must destroy all confidential information by any data provider, not later than five years after the information was provided to the competent authority. |
