This article will count 0.25 units (15 minutes) of unverifiable CPD. Remember to log these units under your membership profile.
The Information Regulator issued infringement notices to First National Bank (FNB) and Central Johannesburg TVET College (CJC) under the Protection of Personal Information Act (POPIA), it announced on 26 October 2026. FNB was fined R1,000,000 and CJC R500,000.
What changed
FNB: FNB reported a security compromise under section 22 after media reports that customer information, including account numbers, was accessed without authorisation through its digital home loan application platform. After a compliance assessment under section 89, the Regulator found:
weaknesses in how FNB identified, classified and responded to repeated security incidents;
that FNB had deficiencies in implementing the security safeguards required by section 19; and
weaknesses in its governance of retention of personal information.
The Regulator found FNB committed an offence under section 105 and issued an enforcement notice and an infringement notice.
CJC: Three people complained that CJC shared their personal information with third parties without a lawful reason. An enforcement notice issued on 22 May 2026 required CJC to register its Information Officer and Deputy, apologise to the complainants, develop a POPIA compliance framework, train staff and discipline the employee responsible. After the 120-day period, the Regulator found CJC had not complied, including failing to report the breach as prescribed.
Who it affects
All responsible parties that process personal information, including accounting practices that hold client financial data.
What this means for accountants and finance professionals
The Regulator fined CJC R500,000 after it failed to comply with an enforcement notice.
Security compromises must be reported under section 22.
The Regulator found weaknesses in the section 19 security safeguards on FNB's online home loan application platform.
Retention policies for personal information are part of what the Regulator assesses.
The Regulator ordered CJC to register its Information Officer and Deputy Information Officer.
What to do
Check that your practice's Information Officer is registered.
Review security safeguards on any portal where clients upload documents.
Confirm you have a documented process for reporting security compromises.
Review how long you keep client personal information and why.
Sources: Information Regulator media statement, 26 October 2026, Information Regulator media statements