“South Africa’s Information Regulator imposed a R1 million fine on First National Bank (FNB) over multiple alleged breaches of the Protection of Personal Information Act (POPIA), including a system error that exposed information belonging to 88 people to 696 unauthorised individuals. The regulator also raised concerns about how the bank collected certain personal information and retained customer records, highlighting the importance of effective privacy controls in digital banking.”
FNB’s R1 Million Fine Puts Customer Data Protection and Digital Banking Accountability Under the Spotlight in South Africa
South Africa’s banking sector is facing renewed scrutiny over customer privacy and the protection of personal information after the Information Regulator imposed a R1 million fine on First National Bank (FNB) for violations of the Protection of Personal Information Act (POPIA). The decision highlights the growing importance of data governance, cybersecurity, responsible information collection and accountability as banks increasingly rely on digital platforms to deliver financial services.
According to a report published by MyBroadband on 26 October 2026, the regulator identified several concerns relating to FNB’s handling of personal information. These included a system error that exposed information belonging to home-loan applicants, questions about the collection of information from newspapers and other sources, and the retention of certain personal records without adequate justification.
The case is significant beyond the financial penalty itself. Banks hold sensitive information that customers entrust to them when applying for loans, opening accounts, receiving salaries and conducting everyday transactions. When information is exposed or handled unlawfully, the consequences can extend beyond the bank to affect individual privacy, financial security and confidence in the banking system.
A system error exposed customers’ personal information
One of the most serious incidents described by the Information Regulator involved a security compromise confirmed by FNB on 21 February 2022.
According to the regulator, personal information belonging to 88 data subjects was exposed to 696 unauthorised individuals. The incident was attributed to a system error rather than an external cyberattack.
The reported problem occurred when certain account holders were incorrectly classified as employees. That classification gave them access to information associated with home-loan applicants through the bank’s digital platform.
The information potentially accessible included customers’ full names, identity numbers, contact details, physical addresses, income information, salary details and account numbers. The regulator explained that users could view further information by selecting a list entry containing an affected individual’s name and identity number.
The incident illustrates how weaknesses in internal systems can create privacy risks even when there is no evidence of an outside attacker penetrating a bank’s network.
Financial institutions typically operate complex digital environments in which different categories of customers and employees have different permissions. If these classifications are inaccurate, or if access controls fail to enforce the intended restrictions, sensitive information may become available to people who should not be able to view it.
For customers, the distinction between an external attack and an internal technical error does not eliminate the potential harm. Both can expose confidential information and create opportunities for identity theft, impersonation or targeted fraud.
The regulator also said that two instances of the exposure had been brought to the bank’s attention. According to the published report, users raised concerns in March and May, while FNB acknowledged the second complaint on 27 September.
This chronology raises questions about how quickly organisations identify, investigate and resolve vulnerabilities once they have been alerted to them. Effective incident management requires more than acknowledging a complaint. It requires identifying the underlying cause, containing the exposure, correcting access permissions and assessing whether affected individuals face continuing risks.
Why the R1 million penalty matters
The R1 million fine represents a regulatory consequence for failures involving personal information. The Information Regulator identified breaches across several provisions of POPIA, including provisions concerning the processing and protection of personal data, the collection of information, retention practices and related obligations.
The penalty also reinforces the principle that banks are responsible for establishing appropriate safeguards around the information they collect and process.
POPIA provides a framework for the lawful handling of personal information in South Africa. For financial institutions, compliance involves establishing legitimate reasons for collecting information, ensuring that access is appropriately controlled, maintaining accurate records and retaining information only for justified periods.
The law is particularly relevant to banking because customer data is central to activities such as credit assessments, fraud prevention, identity verification, regulatory reporting and account administration.
However, a legitimate business need to process information does not mean that every form of collection, access or retention is automatically acceptable. Banks must consider the legal basis for their activities and ensure that their internal procedures meet applicable privacy requirements.
The regulator’s decision therefore carries implications for governance and operational risk management across the financial services industry.
A fine can also affect public perceptions of a bank’s reliability. Customers may reasonably expect their financial institution to maintain strong safeguards because they cannot readily avoid sharing certain personal details when seeking essential financial services.
At the same time, the amount of a penalty alone does not establish the full financial impact of a case. The broader consequences depend on factors such as remediation costs, regulatory follow-up, potential legal proceedings and the steps taken to prevent recurrence.
Concerns about collecting personal information from public sources
The regulator identified another issue involving FNB’s collection of personal information from newspapers and other publicly accessible sources.
According to the reports, the bank collected information to support its processes for identifying people associated with money laundering risks and politically exposed persons, referred to in the regulator’s account as Prominent Influential Persons. Such checks can form part of a bank’s efforts to manage financial crime and meet its compliance obligations.
Nevertheless, the regulator questioned whether information appearing in newspapers qualifies as a “public record” under POPIA. It distinguished between information that can be found in a public source and information that meets the relevant legal requirements for collection without direct consent.
This distinction is important for financial institutions because information being available to the public does not necessarily remove privacy obligations.
Banks must balance the need to detect suspicious activity with the obligation to handle personal information lawfully. Financial crime controls may require the use of information from multiple sources, but the institution must still establish that its collection practices comply with applicable legislation.
The issue can be particularly complicated when information is assembled from news reports, corporate records and online searches. Although individual pieces of information may be publicly visible, combining them can create a more detailed profile of an individual.
That profile may then influence how a bank assesses risk or conducts enhanced due diligence. Consequently, financial institutions need clear policies governing what information can be collected, the purpose for collecting it, how it is verified and how long it can be retained.
The regulator’s findings underline the need for compliance teams to review data collection practices regularly rather than assuming that information available online can be used without restriction.
Indefinite retention raises additional privacy risks
The case also involved concerns about FNB’s data-retention schedule.
The Information Regulator criticised provisions that permitted the indefinite retention of certain customer records without a stated legal justification. The reported examples included cancelled or spoiled employee tax certificates, asset ownership records and securities registers.
Retention policies are a significant part of information security. Financial institutions must preserve certain records for legitimate operational, legal and regulatory reasons. However, retaining information indefinitely without a valid basis can increase the amount of data exposed if systems are compromised or access controls fail.
A well-designed retention policy identifies the purpose of each category of information, establishes the applicable retention period and specifies when records should be securely deleted or otherwise disposed of, subject to relevant legal requirements.
Banks also need processes to ensure that these policies operate in practice. It is not enough to publish a retention schedule if systems continue to preserve records beyond the permitted period.
Regular audits, automated deletion procedures where appropriate, documented exceptions and clear responsibility for record management can help reduce unnecessary exposure.
The regulator’s findings suggest that privacy compliance must be considered throughout the information lifecycle, beginning with collection and continuing through access, storage, use and eventual disposal.
Implications for South African banking customers
For ordinary customers, the case serves as a reminder that financial privacy is an important part of banking security.
Customers routinely provide banks with identity documents, income information, residential addresses and contact details. When these details are exposed, they can potentially be used to make fraudulent communications more convincing.
For example, a criminal who already knows a customer’s name, bank relationship or personal circumstances may attempt to impersonate a bank employee. Such information can be used to create messages that appear credible and encourage the recipient to disclose passwords, one-time PINs or other authentication details.
The regulator specifically warned that exposed information could be combined with information obtained from other breaches, increasing the risk of identity theft.
Customers should therefore remain alert to unexpected calls, messages and emails claiming to originate from their bank. They should avoid sharing authentication codes and passwords, independently verify unusual requests and contact the bank through official channels if they suspect that their information has been misused.
These precautions do not transfer responsibility for regulatory compliance from banks to their customers. Instead, they provide an additional layer of protection while institutions address the underlying technical and procedural risks.
Customers who believe their personal information has been compromised should ask the bank what information was affected, what protective measures have been taken and whether further action is recommended. They can also seek guidance from the Information Regulator where appropriate.
What banks should learn from the case
The findings provide several practical lessons for South African financial institutions.
First, access permissions should be reviewed regularly. Systems must distinguish accurately between customers, employees, contractors and other users. Permissions should reflect the minimum access required for each role.
Second, banks should test their digital platforms for weaknesses that could expose information across customer categories. Testing should include realistic scenarios involving incorrect account classifications, inappropriate permissions and unintended disclosure through application interfaces.
Third, institutions need effective processes for responding to complaints. Reports from customers and employees can reveal weaknesses that automated monitoring has missed. Investigations should be documented, escalated appropriately and followed by corrective action.
Fourth, data collection procedures should be assessed against privacy law. Compliance teams need to understand the legal basis for using information from public sources and distinguish legitimate financial crime checks from collection practices that may breach statutory requirements.
Finally, banks should establish clear retention rules and demonstrate that these rules are being followed. Periodic reviews can help identify records that no longer serve a valid purpose.
These measures are relevant not only to FNB but also to other banks and financial service providers that depend on digital systems to manage sensitive customer information.
Digital banking growth increases the importance of trust
South Africa’s banking industry has invested heavily in mobile applications, online platforms, digital payments and other technology-driven services. These developments can make banking more convenient by reducing the need for branch visits and enabling customers to manage their finances remotely.
However, the shift to digital services also means that customers increasingly depend on technology to protect their information and provide reliable access to their money.
A bank’s reputation is therefore influenced not only by the quality of its products and pricing but also by the reliability of its systems, the quality of its customer support and its ability to protect personal information.
The R1 million penalty comes amid separate reporting about FNB service disruptions affecting its mobile application, online banking and card payments on 26 October. That outage was subsequently reported as resolved, according to MyBroadband. The two developments are separate matters and should not be treated as evidence of a common technical cause.
Nevertheless, together they illustrate why operational resilience and data governance are important components of customer confidence.
A temporary service disruption can prevent customers from completing transactions, while a privacy failure can create longer-lasting concerns about the handling of their personal information. Banks must manage both risks through appropriate technology, controls, monitoring and communication.
Conclusion: Accountability is essential to customer confidence
The Information Regulator’s R1 million fine against FNB highlights the importance of protecting personal information in South Africa’s banking industry.
The reported exposure of information belonging to 88 people, concerns about the collection of personal data from public sources and questions about indefinite record retention demonstrate that privacy risks can arise from several different parts of a bank’s operations.
The central lesson is that customer protection requires more than defending systems against external cyberattacks. It also requires accurate access controls, lawful information collection, responsible retention policies and timely responses when vulnerabilities are identified.
For customers, the case reinforces the importance of vigilance when dealing with communications that request sensitive banking information. For banks, it underlines the need to treat privacy compliance as an ongoing operational responsibility rather than a narrow legal obligation.
As digital banking continues to expand, the institutions most likely to maintain customer confidence will be those that combine convenience and innovation with effective safeguards, transparent accountability and reliable service.
The published reporting states that FNB had 30 days to pay the R1 million fine. Any subsequent response, appeal or further regulatory development should be verified through the bank or the Information Regulator before being reported as a confirmed update.
