FNB Fined R1 Million Over Customer Data Security Failures
FNB Fined R1 Million Over Customer Data Security Failures. First National Bank (FNB) has been fined R1 million by South Africa’s Information Regulator after an assessment found shortcomings in the bank’s protection of customer information and its response to repeated security incidents.
The regulator announced the administrative fine on 26 October 2026 after issuing FNB with an Enforcement Notice and an Infringement Notice under the Protection of Personal Information Act (PoPIA).
The assessment followed a security compromise notification submitted by FNB under section 22 of PoPIA. This came after media reports concerning the exposure of customer information and unlawful access to personal information through the bank’s digital home loan application platform.
The information exposed included customers’ account numbers.
According to the Information Regulator, the assessment identified repeated security incidents that interfered with the confidentiality of personal information. It also found weaknesses in the bank’s identification, classification and response to these incidents.
The regulator raised further concerns about the technical and organisational measures FNB had in place to protect personal information against unlawful access and other unauthorised processing.
The assessment also identified shortcomings in FNB’s implementation of the security safeguards required under section 19 of PoPIA, as well as weaknesses in governance frameworks relating to the retention of personal information.
The regulator found that FNB had committed an offence under section 105 of PoPIA. The finding related to the unlawful processing of customers’ account information through the bank’s failure to comply with prescribed security safeguards.
It further found that FNB reasonably ought to have known that a contravention could occur and could cause substantial damage or distress to affected individuals, but failed to take reasonable steps to prevent it.
The Information Regulator has urged public and private organisations to review their compliance programmes, strengthen information-security measures and ensure that Information Officers meet their statutory responsibilities.
The enforcement action highlights organisations’ obligations under PoPIA to protect personal information through appropriate security safeguards and effective governance.
