The Information Regulator fined First National Bank R1 million on 26 October 2026 for failing to protect customers’ personal information, and fined Central Johannesburg TVET College R500,000.

Both fines were imposed under the Protection of Personal Information Act (POPIA), according to the regulator’s media statement, published on 26 October 2026. Each body received an enforcement notice, which orders corrective steps, and an infringement notice, which carries the fine.

The two cases are separate. One involves a bank that serves millions of customers, the other a public college with three complainants, and the statement describes failures to secure personal information and to follow the regulator’s directions.

The FNB finding

The regulator began its assessment of FNB after the bank notified it of a security compromise under section 22 of POPIA. That notification followed media reports about exposed customer information and unlawful access to personal information through the bank’s digital home loan application platform. The exposed information included account numbers.

The assessment found shortcomings in how FNB identified, classified and responded to repeated security incidents. It also found deficiencies in the security safeguards required by section 19 of POPIA and weaknesses in the bank’s governance of how long it retains personal information.

The regulator found that FNB committed an offence under section 105 of the Act. In its words, FNB “reasonably ought to have known” that a contravention was a risk and that it was likely to cause substantial damage or distress to affected people, but did not take reasonable steps to prevent it.

The statement does not include a response from FNB.

The college

The regulator issued the college an enforcement notice on 22 May 2026, after three people complained that their personal information was shared with third parties without legal justification. The notice gave the college 120 days to act. It had to register an Information Officer and a Deputy Information Officer, apologise to the complainants, develop a POPIA compliance framework, train staff and discipline the employee responsible.

The college responded at the end of the 120 days. The regulator found that it had still not reported the security compromise in the prescribed manner, had not developed the compliance framework, had apologised late and had missed deadlines. It called these very serious contraventions.

What the notices ask of others

The Information Regulator said in the statement that public and private bodies should review their compliance programmes, strengthen information-security safeguards, make sure Information Officers carry out their duties and respond promptly to its directives. The notices, it said, show how seriously it treats failures to protect personal information.

Other recent stories on how South African institutions handle personal data include the Home Affairs Smart ID service at banks and the Pension Funds Adjudicator’s record complaints. The regulator’s statement gives no date for any further step against either body.

Media enquiries go to the regulator’s spokesperson, Nomzamo Zondi, at nzondi@inforegulator.org.za.