Regulator Fines FNB R1 Million Over Data Breach
The Information Regulator issued the penalty following a system error that exposed sensitive customer information.
Updated on Oct. 26, 2026 in Cybersecurity
Live Poll
Do you trust your primary bank to adequately protect your personal information from unauthorized access?
South Africa's Information Regulator has fined First National Bank R1 million for violating the Protection of Personal Information Act. The penalty follows a 2022 security failure that allowed unauthorized users to view sensitive data.
Why it matters
The fine underscores the critical importance of data processing and retention compliance for financial institutions under South African law. It highlights the potential legal and financial risks banks face when sensitive information is not properly safeguarded.
A 2022 system error incorrectly categorised account holders as employees, granting 696 unauthorised individuals access to the personal records of 88 data subjects. The bank additionally faced criticism for retaining customer records longer than required.
The players
First National Bank
One of South Africa's largest financial services providers offering a wide range of retail and commercial banking products.
Information Regulator
The South African statutory body empowered to monitor and enforce compliance with the Protection of Personal Information Act.
The details
The breach occurred through the FNB banking app, where users were able to access sensitive home loan applicant information simply by clicking on specific list items. The bank had collected these records from various public sources, including company registers and newspapers, but failed to justify the duration for which they were stored.
Timeline
21 February 2022: Security compromise exposed the personal information of 88 data subjects.
October 2026: The Information Regulator issued a R1 million fine to FNB.
November 2026: Deadline for FNB to pay the fine or elect to be tried in court.
The Tech Race
This enforcement action marks a significant step in the tightening of digital privacy standards across the South African banking sector. It signals a move away from legacy data retention practices toward a more strictly regulated framework for sensitive customer information.
Customers should remain vigilant and review their privacy settings within banking applications to understand what data is being shared or stored. This case serves as a reminder to report any suspicious access or errors directly to the bank's security department.
The takeaway
Financial institutions are increasingly held to strict standards regarding how they process and store client data. Readers should regularly audit their own digital footprint and contact their banks if they suspect their private information has been mishandled.
What happens next
FNB has until November 2026 to either pay the R1 million penalty or proceed to court to contest the regulator's findings.
Further reading
Learn more about the latest developments in cybersecurity within the region.
Live Poll
Do you trust your primary bank to adequately protect your personal information from unauthorized access?
