South Africa fines FNB R1m over exposed home-loan account data

South Africa fines FNB R1m over exposed home-loan account data

26 October 2026: South Africa's Information Regulator has fined First National Bank R1 million under the Protection of Personal Information Act (POPIA), after customer information, including account numbers, was exposed and accessed without authorisation through the bank's digital home-loan application platform. The Regulator also found that FNB committed an offence under section 105 of the Act. In a separate decision it fined Central Johannesburg TVET College R500,000 for failing to carry out an enforcement notice.

Not yet independently verified. Everything here comes from the Information Regulator's own statement. It does not say how many customers or students were affected or when FNB's incident happened, and we have not read a response from FNB or the college. We will update this when it can be confirmed, and remove this note.

The Regulator announced both infringement notices in a media statement on 26 October.

What the Regulator found at FNB

The case began with FNB's own notification of a security compromise under section 22, after media reports of exposed customer data. The Regulator then ran a compliance assessment under section 89. It found significant shortcomings in how the bank identified, classified and responded to repeated security incidents, deficiencies in the security safeguards that section 19 requires, and weak governance of how long personal information was kept.

The offence finding goes further than a compliance failure. Section 105 makes it an offence for a responsible party to process account numbers unlawfully, and the Regulator concluded that FNB "reasonably ought to have known" there was a risk of substantial damage or distress to customers and did not take reasonable steps to prevent it. The statement does not give the date of the incident or the number of customers whose data was exposed.

A college that ran out its 120 days

Central Johannesburg TVET College was served an enforcement notice on 22 May 2026, after three people complained that their personal information had been shared with third parties without legal justification. The notice told the college to register its information officer and deputy, apologise to the complainants, write and submit a POPIA compliance framework, train its staff and discipline the employee responsible.

When the 120 days were up, the Regulator found the college had not reported the data breach in the prescribed way, had not produced the compliance framework, had delayed the apology and had missed its deadlines. It called these "very serious contraventions" and issued the R500,000 fine.

What the decisions signal for other organisations

The two cases show the two routes to a fine under POPIA: a breach investigated on its own merits, and an enforcement notice left unmet. The Regulator used the statement to call on public and private bodies to review their compliance programmes, strengthen security safeguards, make sure information officers do their jobs and answer its directives promptly. For banks and lenders, the section 105 finding is the sharper point, because it attaches criminal liability to account data processed on a platform that lacks adequate safeguards. The statement does not say whether either party will appeal or when the fines fall due.

Related on TrustList:

• SBP makes SMEConnect the only route for SME loan applications
• South Africa: green ID book production ends on 31 March 2027 and the book stops being valid ID on 31 March 2028

Sources

• Information Regulator (South Africa): media statement, Regulator fines CJC and FNB for POPIA contravention, 26 October 2026
• Information Regulator: media statements, 2026, 26 October 2026