South Africa Fines FNB R1 Million Over Customer Data Failures

South Africa’s Information Regulator has imposed a R1 million penalty on First National Bank after finding failures in how the bank protected and handled personal information. The regulatory action was announced in October 2026. The customer-data exposure at the centre of the case happened in 2022, so this is a new enforcement development, not a newly discovered breach.

The regulator’s enforcement notice addresses more than the immediate exposure. It examines collection, retention and security practices under South Africa’s Protection of Personal Information Act, known as POPIA. A 26 October legal analysis says the notice was issued on 21 October and also raises questions about how information taken from public sources may be used in anti-money-laundering checks.

According to reporting based on the regulator’s statement, a February 2022 system error caused some individual account holders to be classified as employees. That error gave 696 unauthorised people access to information relating to 88 home-loan applicants. Exposed details included names, identity numbers and contact information. The two numbers describe different groups: affected applicants and people who could see their data. They should not be combined into a single count of breached customers.

The regulator also found problems with the bank’s safeguards and with how long certain records were retained. It questioned the collection of information from newspapers and other sources for screening politically exposed customers. A newspaper may be publicly available, but that does not automatically make every detail in it a public record that can be collected without further legal justification. The tension with banks’ financial-crime obligations makes this part of the decision especially significant for the wider sector.

The amount is small next to the scale of a major bank, but the decision reaches into routine digital banking controls. Access permissions, classification of users, data retention and lawful collection are ordinary parts of an app or back-office platform. A mistake in any of them can expose information even without an outside attacker breaking into the system.

FNB has 30 days to pay the fine or elect to contest the matter in court, according to the regulator’s account reported by BusinessTech. The penalty should therefore not be described as already paid. The notice also requires attention to the underlying compliance failures. It remains important to watch whether the bank challenges the decision and what remediation it documents.

For customers, this case illustrates that privacy risks are not limited to phishing or password theft. Internal access rules and old data kept longer than needed can matter just as much. TechBooky earlier reported on a separate exposure affecting South African users of Booking.com. The FNB matter is distinct, but both show why clear notification and careful handling of personal records matter after an incident.

The broader test is whether banks can show that their privacy policies work inside their actual systems. Regulators will expect more than written rules. They will look at who can access sensitive records, why those records were collected, when they are deleted and how quickly errors are detected and corrected.