The firm acknowledges it failed to notify the regulator of its 2019 data breach within the required time.