On 26 October 2026, South Africa's Information Regulator announced administrative fines under the Protection of Personal Information Act (POPIA) against First National Bank (R1 million) and Central Johannesburg TVET College (R500,000). The amounts are small next to the statutory ceiling. The pattern behind them is more interesting than the numbers.
The strongest case for the Regulator
The case for firm enforcement is easy to state. Banks hold some of the most sensitive data a person has, and customers cannot negotiate over how a bank secures it. According to TechCentral, a misconfigured setting in an FNB app let 696 customers view the home loan applications of 88 other people, including nine account numbers. A customer flagged the problem on 30 March 2022 and another on 3 May 2022. FNB removed access, but the Regulator's notice says it did not address the underlying vulnerability even after two alerts.
That is the kind of failure the law exists to catch. Section 19 of POPIA requires 'appropriate, reasonable technical and organisational measures', and that means identifying foreseeable risks and regularly verifying safeguards. Repeated incidents that go unfixed are hard to defend under that standard. Without enforcement of this kind, a statute is only a set of suggestions.
What the cases actually show
The two fines rest on different logic. The FNB fine followed a compliance assessment and rests on weak safeguards across repeated incidents. The Regulator also found that FNB committed an offence under section 105, which ITWeb reported the Regulator described as 'of regulatory significance'. Section 105 is a narrow provision on account numbers. It applies only where a contravention is 'of a serious or persistent nature' and the party knew of the risk and failed to take reasonable steps. Using it signals that the Regulator reads FNB's inaction after warnings as knowing, not accidental.
The College fine is a different kind of case. It followed non-compliance with a 22 May 2026 Enforcement Notice: no breach report in the prescribed manner, no compliance framework, a late apology and missed deadlines. The underlying incident was not what triggered the penalty. The ignored order was.
This matches the Regulator's earlier practice. Its first administrative fine, R5 million against the Department of Justice in July 2023, was imposed after the department failed to show it had complied with an enforcement notice. A graduated model, where the regulator warns and instructs first and fines when the instructions are ignored, is a proportionate design. It rewards organisations that fix problems and penalises those that stonewall.
Where the model needs work
Three problems stand out.
First, the timeline is long. The first customer alert came in March 2022 and the Regulator received a complaint in September 2022. FNB says the assessment was conducted in October 2023. The fine arrived in October 2026. Deterrence depends on how soon a penalty follows the conduct, and a four-year gap tells a compliance officer that a breach is a problem for the next budget cycle. Slow enforcement also hurts regulated firms that did the right thing, because the rules stay unsettled long after the facts are known.
Second, the fines are small relative to the power available. Section 109(2)(c) allows up to R10 million, and the factors in section 109(3) include the number of data subjects affected and whether the contravention could have been prevented. The Regulator chose R1 million for a bank that ignored two warnings. Restraint is defensible, and FNB describes the penalty as 'nominal' and says remediation is complete with no customer suffering financial harm, per ITWeb. But the Regulator should publish how it weighs the section 109 factors. At present, firms cannot tell whether R1 million reflects the limited harm, the bank's cooperation or the Regulator's capacity.
Third, enforcement is concentrated where it is easy. Every case so far involves a named institution that is visible, documented and unable to claim ignorance. That is a reasonable start. But predictable outcomes for similar facts matter more to innovators than a few headline fines. Start-ups building on customer data need to know what reasonable safeguards look like in practice. A bank can absorb a R1 million fine. A ten-person fintech cannot absorb an unclear standard.
What a better regime looks like
An evidence-based approach would do four things:
- Publish enforcement notices and assessment findings with consistent structure, so firms can benchmark their controls against actual findings.
- Set target timelines from complaint to decision, and report performance against them.
- Explain fine calibration against the section 109(3) factors, so penalties track harm and conduct instead of looking arbitrary.
- Keep the escalation ladder intact. Sanctions should hit hardest where an organisation ignores a lawful order, as the College did, or leaves a known flaw open, as the Regulator found at FNB.
None of this requires new legislation. The statute already gives the Regulator the powers and the discretion. What it needs is the resources and procedural discipline to turn them into prompt, legible decisions.
The bottom line
The FNB and College decisions are defensible and aimed at the right behaviours: ignoring warnings and defying orders, not suffering a breach as such. For a pro-innovation reading of POPIA, that is the right target. The weakness is time. A regime in which a customer's warning in 2022 produces a penalty in 2026 protects data less than its rules promise, and gives businesses less certainty than they need.