The Information Regulator slapped First National Bank (FNB), the country’s second‑largest lender, with a R1 million (about $60,000) fine on October 23 after the bank’s system error exposed personal data of 88 home‑loan applicants to 696 unauthorised users, a breach that has now become known as the “FNB fine.”
The regulator’s investigation found that a coding mistake mis‑classified certain account holders as employees, inadvertently granting internal staff access to sensitive information that should have remained confidential. Those unauthorised users were able to view details such as names, ID numbers, addresses, salaries and loan application data, compromising the privacy of the affected borrowers.
FNB was first alerted to the mishandling of data in March 2022, and a second complaint arrived in May of the same year. However, the bank only acknowledged the issue in September, according to the regulator’s report. The delayed response meant the breach persisted for months, allowing the unauthorised access to continue unchecked.
Beyond the mis‑classification error, the regulator criticised FNB’s broader data‑handling practices. It highlighted that the bank had built databases on individuals linked to money‑laundering concerns and politically exposed persons using newspaper reports, sources that do not qualify as public records under the Protection of Personal Information Act (POPIA). Moreover, FNB’s retention policy was called out for keeping records such as cancelled tax certificates, asset ownership documents and securities registers indefinitely, without a clear legal basis for doing so.
Under POPIA, organisations are required to process personal data lawfully, keep it secure and retain it only for as long as necessary. The regulator concluded that FNB breached several provisions, including unlawful processing of an account number and failure to implement adequate safeguards. As a result, the bank now faces a 30‑day window to either pay the R1 million fine, negotiate an instalment plan, or challenge the penalty in court. Failure to act will enable the regulator to recover the amount as a civil judgment.
The fine arrives at a time when South African banks are under increasing scrutiny over their data‑protection frameworks. Recent high‑profile incidents, such as the exposure of customer details at other major lenders, have intensified public demand for stricter compliance. For ordinary South Africans, the breach show the vulnerability of personal financial information in an increasingly digital banking environment.
Industry analysts note that the incident may prompt banks to revisit their data‑governance strategies, investing in more robust classification systems and clearer retention policies. While the immediate financial impact of the fine on FNB’s bottom line is modest, the reputational damage could be more significant, especially if customers lose confidence in the bank’s ability to safeguard their information.
FNB’s senior management has not yet issued a detailed public statement, but the regulator’s report indicates that the bank is aware of the shortcomings and is expected to submit a corrective action plan within the next few weeks. The regulator will monitor compliance closely, and any further breaches could attract additional penalties.
The next step for FNB is to decide whether to pay the fine outright, propose an instalment arrangement, or contest the decision in court. Whichever route the bank chooses, it will need to demonstrate concrete improvements in data handling and retention to restore trust among regulators and customers alike.
