FNB POPIA Fine What South African Businesses Must Learn

What the FNB POPIA Fine Teaches South African SMEs

South Africa’s Information Regulator has fined FNB R1 million after finding shortcomings connected to unlawful access through the bank’s digital home-loan application platform. The decision, announced on 26 October 2026, is already attracting attention because of the FNB name and the size of the fine. The more useful story, though, is what the regulator says businesses got wrong.

This is not simply a “bank was hacked” headline. The regulator focused on how incidents were identified, classified and handled; whether appropriate technical and organisational safeguards were in place; how personal information was retained; and whether accountable people were properly involved. That makes the FNB POPIA fine relevant to every South African business holding ID copies, banking details, customer records or employee information.

A data incident is not just an IT ticket

One of the easiest mistakes is to treat each strange event as an isolated support problem. A customer sees someone else’s information, a staff member reports unexpected access, or a system behaves oddly. The ticket gets closed once the immediate symptom disappears, and nobody asks whether similar reports point to one bigger problem.

A sensible data breach response process should record what happened, what information was involved, who had access, how many people may be affected and whether the same pattern has appeared before. In plain English: join the dots. If five people report the same sort of exposure, that is no longer five small incidents.

POPIA security safeguards include people and process

Section 19 of POPIA is often reduced to antivirus, firewalls and strong passwords. Those matter, but the law refers to appropriate technical and organisational measures. For a South African SME, that can include role-based access, multifactor authentication, patching, useful logs, supplier oversight, secure device handling, staff procedures and a clear escalation route.

The right level of control depends on the information and the risk. A public newsletter list is not the same as a folder containing ID documents, medical records or bank statements. Small businesses do not need bank-sized security teams, but they do need choices they can explain and evidence they can produce.

Keeping everything forever creates risk

Old information is still information. Copies sit in email attachments, exported spreadsheets, forgotten website databases, former employees’ OneDrive folders, backups and devices sent in for repair. Every unnecessary copy increases the number of places that must be secured and searched during an incident.

A practical retention schedule should state why each category is collected, how long it is needed, where it is stored and who is allowed to delete it. This does not mean blindly deleting records after 30 days. Tax, employment, insurance and contractual requirements still matter. The goal is to stop “keep it forever, just in case” from becoming the default.

Your Information Officer needs a real operating role

Registering an Information Officer is not the same as giving that person visibility and authority. They need to know about system changes, incidents, suppliers, retention decisions and data-subject requests. The business also needs a backup person and a contact process that still works after hours.

Where IT is outsourced, responsibility is shared rather than magically transferred. An MSP can patch a server, preserve logs and explain technical scope. Management still needs to make decisions about legal duties, notification and communication. Those responsibilities should be agreed before an incident, not debated while everyone is under pressure.

What South African SMEs should do now

Start with a short tabletop test. Imagine a shared cloud link exposes customer documents or a website displays another applicant’s information. Ask who notices, who can disable access, which logs exist, who establishes the scope and who assesses whether notification under section 22 is required.

The FNB fine does not mean every mistake automatically costs R1 million. It does show that the Information Regulator looks beyond the initial technical fault. The real question is whether the organisation understood the risk, connected warning signs, maintained appropriate safeguards and responded responsibly.

For many SMEs, that is actually good news. You do not need a glossy 100-page policy that nobody reads. You need sensible access, useful evidence, clear ownership and a response process that works when things go sideways.

RandTech IT call to action

Ask RandTech IT for a practical POPIA security and incident-governance review covering access, retention, logging, escalation and technical safeguards.

Publishing and social copy

Internal link recommendation: Link “POPIA security assessment” to the RandTech IT Cybersecurity or Business IT Support page.

Google Business Profile: The FNB POPIA fine is not only a banking story. It shows why South African SMEs need clear incident ownership, sensible retention and security controls they can prove are working.

LinkedIn: The Information Regulator’s FNB decision is a governance lesson, not just a hacking headline. Repeated incidents must be connected, classified and acted on—and personal information should not be kept indefinitely because “storage is cheap”.

Facebook: FNB has been fined R1 million by the Information Regulator. For smaller businesses, the lesson is not to panic. Know what personal information you hold, limit access, keep useful logs and make sure somebody actually owns the incident process.

Sources

Information Regulator South Africa media statement 26 October 2026

RandTech IT FNB POPIA analysis source notes