FNB fined R1m over PoPIA customer data security failures

Marcus Bennett

South Africa’s Information Regulator fined FNB R1 million on 26 October 2026 for unlawful processing of customers’ account information and failures to comply with data-security safeguards under the Protection of Personal Information Act (PoPIA).

The administrative penalty followed an assessment of FNB’s compliance with PoPIA. The regulator issued the bank an Enforcement Notice and an Infringement Notice.

What triggered the assessment?

The case concerns a security compromise involving FNB’s digital home-loan application platform. Media reports described exposure of customer information and unlawful access before FNB submitted a notification under section 22 of PoPIA.

The regulator’s assessment followed that notification. According to the regulator, exposed information included customers’ account numbers. The regulator found repeated security incidents that constituted “interference with the confidentiality of personal information.”

What did the regulator find?

The assessment covered both the bank’s response and its underlying controls. Weaknesses appeared in how FNB identified, classified and responded to repeated incidents. The regulator also found deficiencies in the technical and organisational measures used to protect personal information.

Two compliance failures carried particular weight. The regulator found weaknesses in FNB’s implementation of the safeguards required by section 19 of PoPIA. It also identified deficiencies in the bank’s governance frameworks for retaining personal information.

The regulator found that FNB had committed an offence under section 105 of PoPIA. That finding related to unlawful processing of customers’ account information because the bank failed to comply with section 19 safeguards.

The decision also addressed what FNB knew and what it failed to do. The regulator found that FNB “reasonably ought to have known” a contravention could occur. It said the contravention was “likely to cause substantial damage or distress” to affected individuals.

FNB nevertheless failed to take reasonable steps to prevent the contravention. The R1 million administrative fine followed the findings on these security and governance shortcomings.

Why did the assessment extend beyond the initial exposure?

The assessment did not stop with the platform incident. It considered repeated incidents and their consequences for confidentiality, unlawful access, unauthorised processing and compliance with section 19. It also tested FNB’s governance of retained information and whether FNB reasonably should have known a contravention could occur.

The assessment linked technical weaknesses to organisational governance. It found weaknesses in incident identification, classification and response, in the safeguards protecting personal information, and in retention frameworks. Those issues sat alongside the bank’s failure to comply with section 19.

What does the enforcement outcome require?

The regulator called on public and private bodies to review their compliance programmes. It asked them to strengthen information-security safeguards and ensure that Information Officers fulfil their statutory responsibilities. It also called for prompt responses to regulatory directives.

For legal and compliance teams, the immediate consequence is a control review rather than a review limited to the original notification. The assessment reached recurring incidents, the organisation’s knowledge of likely harm, preventive action and governance over retained information.

Key review questions include:

• Can the organisation identify, classify and respond to repeated security incidents?
• Do technical and organisational measures prevent unauthorised access and other forms of unauthorised processing?
• Are section 19 safeguards implemented in practice?
• Does governance address the retention of personal information?
• Can Information Officers show that statutory responsibilities are being fulfilled?
• Can decision-makers document likely harm, their knowledge and reasonable preventive steps?

The warning extends beyond FNB. The regulator addressed public and private bodies, making information-security governance relevant to organisations that hold personal information. The enforcement action underscores PoPIA’s requirements for appropriate security measures and effective organisational governance. It places particular weight on Information Officers, preventive steps and the organisation’s response to regulatory directives.