FNB fined R1 million over client data. How to complain if it's yours

The Information Regulator has fined First National Bank (FNB) R1 million for breaking the Protection of Personal Information Act (POPIA). The infringement notice, signed by regulator chairperson Pansy Tlakula on 21 October 2026, gives the bank 30 days to pay, arrange to pay in instalments, or choose to be tried in court instead.

The regulator found FNB guilty of an offence under section 105(1) of POPIA, which covers the handling of account numbers, the notice states.

What did FNB get wrong, according to the regulator?

The biggest finding goes back to a system error in 2022. On 21 February 2022, FNB confirmed that the personal information of 88 people had been exposed to 696 unauthorised individuals, the regulator said in its statement, reported by MyBroadband.

Some ordinary account holders had been wrongly classified as employees. That let them see the details of home loan applicants in the FNB app, including:

• full names and ID numbers
• contact details and physical addresses
• income and salary information
• account numbers

App users flagged the problem to the bank in March and again in May that year. "FNB did not address this vulnerability to the confidentiality of personal information even after two alerts by two parties," the regulator said. It warned that exposed details can be combined with data from other breaches and used for identity theft.

The regulator also listed two other breaches, according to MyBroadband:

• Newspaper data. FNB used newspapers to build its records on people linked to money laundering and politically exposed people. The regulator said newspapers are not a "public record" under section 12 of POPIA.
• Keeping records forever. FNB's retention schedule allowed some personal records, such as cancelled employee tax certificates and asset ownership records, to be kept indefinitely without a stated legal reason, which the regulator said breached section 14(1).

What happens if FNB doesn't pay?

If the bank neither pays nor arranges instalments nor elects a court trial within 30 days, the regulator can file a certified statement with a court, and it then counts as a civil judgment for the amount, the notice says. Under section 109 of POPIA, an administrative fine can be as high as R10 million.

Does a company have to tell you if your data leaks?

Yes. When there are reasonable grounds to believe someone unauthorised accessed your personal information, the company must notify both the regulator and you as soon as reasonably possible, under section 22 of POPIA. The notice must be in writing and help you protect yourself.

How do you complain to the Information Regulator?

The service is free. You can:

• lodge online on the regulator's POPIA complaints portal, which gives you a reference number to track the case
• fill in POPIA Form 5 and email it to [email protected], as listed on the contact page

Attach what you have: emails, SMSes, screenshots, dates and any reply from the company's information officer. Simple complaints are usually finalised within three months and complex ones can take up to 12 months, the regulator says.

For questions, call the regulator toll-free on 0800 017 160 or on 010 023 5200, or email [email protected] (contact details).