What do the FNB and TVET POPIA fines mean for your marketing database?

Published Wednesday, 28 October 2026 | By Noleen Thompson, LadyBugz Marketing

South Africa’s Information Regulator announced two fines under POPIA, the Protection of Personal Information Act and the country’s data protection law, on 26 October 2026: R1 million against First National Bank (FNB) and R500 000 against Central Johannesburg TVET College. The Regulator found that the bank had failed to keep customer information on a loan platform secure, and that the college had shared employee records without legal justification and then not done what it was told. Neither looks like a marketing story. Both are, if your business holds a customer list.

We read notices like these with our clients’ databases in mind. When we look at a company’s lead lists for the first time, the picture is usually familiar: spreadsheets exported years ago, files merged after events, an old agency’s login still active, and no column anywhere saying where a contact came from or what they agreed to. Nobody planned it. It just piled up.

What did the Information Regulator announce on 26 October 2026?

The Information Regulator announced on 26 October 2026 that it had issued enforcement notices and infringement notices against FNB and Central Johannesburg TVET College, and fined them R1 million and R500 000. The Regulator is the independent body that enforces POPIA.

TechCentral and ITWeb reported the FNB fine on 27 October 2026, which is why you may have seen both dates. Under section 109 of POPIA, an administrative fine can go up to R10 million. A security compromise is POPIA’s term for what most people call a data breach, and the Regulator’s statement uses both phrases. The person the information is about, whether a customer, a prospect or an employee, is called the data subject.

Why was FNB fined R1 million?

FNB was fined R1 million because the Regulator found that the bank had not put adequate security safeguards in place to protect customers’ personal information, including account numbers exposed through its digital home loan application platform. The Regulator also found that FNB had committed an offence under section 105 of POPIA, the section dealing with account numbers.

According to the Regulator’s media statement of 26 October 2026, its compliance assessment began after FNB submitted a section 22 security compromise notification, following media reports about customer information being exposed. TechCentral reports, on 27 October 2026, that a customer complaint reached the Regulator in September 2022. The assessment was carried out under section 89, the Regulator’s power to examine whether an organisation handles personal information lawfully. The Regulator found:

• shortcomings in how FNB identified, classified and responded to repeated security incidents;
• deficiencies in the technical and organisational measures that section 19 requires, meaning the systems and procedures that keep information safe;
• weaknesses in the governance frameworks that decide how long personal information is kept;
• that FNB “reasonably ought to have known” there was a risk, that the failure was likely to cause substantial damage or distress, and that the bank did not take reasonable steps to prevent it.

TechCentral’s report, based on the enforcement notice dated 21 October and signed by Regulator chair Pansy Tlakula, puts numbers to it. According to TechCentral, 696 customers could see the home loan applications of 88 applicants, and nine of those applicants had their account numbers exposed. FNB has 90 days to report back with evidence of what it has fixed, and 30 days to appeal.

PPM Attorneys (27 October 2026) and TechCentral report further findings in the full enforcement notice, about where FNB collected some personal information and how long it kept records. Those points are not in the Regulator’s media statement.

The phrase a marketer should notice is “repeated security incidents”. Most marketing teams have no process for recognising and sorting incidents at all. If someone in sales emails the wrong spreadsheet to a supplier, does anybody ask whether it’s a security compromise? Usually not.

Why was a TVET college fined R500 000 over shared records?

Central Johannesburg TVET College was fined R500 000 because the Regulator found it had failed to comply with an enforcement notice issued on 22 May 2026. That notice followed complaints from three people whose personal information, according to the Regulator’s statement, had been shared with third parties without legal justification.

ITWeb, reporting on the enforcement notice on 1 June 2026, said the records were employees’ qualification verification and criminal record verification reports, placed in a folder of finance policies that was circulated by email in September 2022. Criminal record information is special personal information under POPIA, with stricter protection than a name and email address. The enforcement notice ordered the college to:

1. register its Information Officer and Deputy Information Officer with the Regulator;
2. apologise to the complainants;
3. develop and submit a POPIA compliance framework;
4. run POPIA awareness and training for employees;
5. take appropriate disciplinary action against the employee responsible.

After the 120 days set in the notice, the college responded. The Regulator found the breach had not been reported in the prescribed manner, the compliance framework had not been developed, the apology was late and timeframes had been missed. It called these “very serious contraventions of POPIA” and issued the R500 000 fine.

If ITWeb’s account is right, nobody hacked the college. The records went to colleagues, and that still counted. The fine came from what happened afterwards.

Ignoring an enforcement notice is where the big fines come from

Failing to comply with an enforcement notice has been behind several of the Regulator’s fines, including its very first one. The Department of Justice and Constitutional Development was fined R5 million in July 2023 for not complying with an enforcement notice issued after its 2021 ransomware attack, as Norton Rose Fulbright and TechCentral reported in July 2023.

The college’s case has the same shape: a mistake, an order, a deadline, then a fine because the fixing didn’t happen. FNB’s enforcement notice and infringement notice were issued at the same time, as the Regulator’s statement describes it, for the failures themselves. That comparison is our reading, not the Regulator’s.

The Regulator’s own advice, in its 26 October statement, is to strengthen security and respond promptly to directives. For a marketing team that means one thing. If a letter from the Regulator lands, it goes to the top of the pile, with every deadline in the diary.

What do these fines mean for a marketing or customer database?

A marketing or customer database is personal information under POPIA, so the rules these two organisations broke apply to it directly. Your lists need to be kept secure, kept only as long as you need them, reported when they leak, and owned by someone accountable.

• CRM exports, email platform logins, shared drives, agency access and the trade show list on someone’s laptop all count as security safeguards under section 19.
• FNB’s retention weaknesses are a bank-sized version of something we see constantly. A 2019 list still mailed every month is information you are choosing to keep.
• The college case shows the wrong colleague is a problem too, and sales and marketing teams pass spreadsheets around all day.
• Marketing data needs a named person who knows what is held and why. The college was ordered to register its Information Officer for a reason.

Direct marketing has extra rules on top of all this. Section 69 of POPIA requires consent before you send electronic direct marketing, such as email or SMS, to people who are not your customers. Cliffe Dekker Hofmeyr reported in March 2024 that the Regulator’s chairperson had warned: “Our leniency regarding direct marketing through unsolicited electronic communications is going to be a thing of the past.” That followed the Regulator’s first direct marketing enforcement notice, issued to FT Rams Consulting in February 2024.

We covered the cost of getting consent wrong in our article on POPIA and the opt-out registry, and the alternative, building lists people choose to join, in our guide to permission-based marketing.

What to do this week: a checklist for marketing teams

A marketing team can make real progress on POPIA in a week without starting a big project. Start with these:

1. Find out who your Information Officer is, and confirm they are registered with the Regulator. In most private companies it is the CEO unless the role has been delegated.
2. List every place customer and prospect data lives: CRM, email platform, spreadsheets, shared drives, event apps and any agency or freelancer accounts.
3. For each list, write one line on where it came from and why you are allowed to use it. If nobody can write that line, pause sending to it until somebody can.
4. Agree a retention rule for prospect data, and then delete something. A rule that has never deleted a record isn’t working yet.
5. Check who has access to your marketing systems. Remove people who have left and agencies you no longer use.
6. Tell the team that a misdirected email or a wrongly shared file counts as a possible security compromise, and name who decides whether it gets reported.
7. If your business has ever received anything from the Regulator, find it and check every deadline in it.

If you market outside South Africa as well, our Global B2B Outreach Compliance Cheat Sheet covers the main rules in other markets. And if you’re already planning a marketing audit, put your lists on the agenda. You can also see how we handle personal information ourselves on our POPIA compliance page.

Frequently asked questions

What is POPIA?

POPIA is the Protection of Personal Information Act, South Africa’s data protection law. It sets the conditions under which any business, school, government department or charity may collect and use information about identifiable people, and the Information Regulator enforces it.

What is an Information Officer, and do I need one?

An Information Officer is the person responsible for POPIA compliance inside an organisation, and every organisation has one. In a private company the head of the business, usually the CEO, fills the role by default and can appoint deputies. The Information Officer has to be registered with the Regulator, which is one of the first things the college was ordered to do.

Does an accidental internal email count as a breach?

An accidental internal email can count as a security compromise under POPIA. Section 22 applies when there are reasonable grounds to believe personal information has been accessed or acquired by an unauthorised person, and a colleague with no reason to see it can be that person.

Can I market to a list I bought or scraped?

A bought or scraped list is risky for electronic direct marketing, because section 69 of POPIA requires consent from people who are not your customers, and that consent has to cover you. Buying a list doesn’t transfer anyone’s permission, and being visible online isn’t permission to email someone. The safe principle is to market to people who chose to hear from you, or to existing customers who can opt out every time.

How big can a POPIA fine be?

A POPIA administrative fine can be up to R10 million under section 109, and some offences can also lead to a prison sentence.

If we were having lunch and you asked me what to do about all this, I’d tell you to forget the bank for a moment and open your CRM. Look at the oldest list in there and ask who added it and why. If the answer is “no idea”, you have your first job. Most businesses we see aren’t careless, just busy. An afternoon sorting out where your contacts came from costs a lot less than a letter from the Regulator.

Not sure where your lists came from? Book a data and consent audit

Noleen Thompson, LadyBugz Marketing. Get in touch: noleen@ladybugz.co.za

Editorial note: this article is commentary on publicly reported cases, not legal advice. It is based on the Information Regulator’s media statement of 26 October 2026 and on news and law firm reporting credited above. If your business needs advice on its own POPIA position, speak to a qualified legal adviser.

Keep reading

How do you segment a B2B market and choose your ideal customer profile?

B2B market segmentation by business need and buying committee, not only industry, and how to choose your ideal customer. South African examples.

When does a growing B2B company need a new brand strategy?

A growing B2B company needs a new brand strategy when its story no longer matches the business. The signs, why AI matters and what to fix before the logo.

What does a board-ready B2B marketing plan include?

A B2B marketing plan your board will back ties marketing to revenue in plain English: goal, buyers, message, channels, measures and a 90-day roadmap for 2027.