Information Regulator Fines FNB R1 Million, CJC R500,000 Under POPIA

South Africa's Information Regulator fined First National Bank R1,000,000 and Central Johannesburg TVET College R500,000 for POPIA contraventions, announcing both in a media statement dated 26 October 2026. Each fine arrived by Infringement Notice, which the Act treats as an alternative to criminal prosecution rather than a conviction.

Information last verified on November 3, 2026. This is a developing story; we update it as the record changes.

Status: The Information Regulator announced the Enforcement Notices, the Infringement Notices and both administrative fines in a media statement dated 26 October 2026. As of 3 November 2026 the Regulator's media-statements index carries no later statement on either matter, and the 26 October statement records no payment, no election to be tried in court, and no appeal by either responsible party.

Jurisdiction scope: This covers data protection enforcement in South Africa under the Protection of Personal Information Act 4 of 2013 (POPIA) and the powers of the Information Regulator of South Africa. It does not cover the EU General Data Protection Regulation, United Kingdom data protection law, or any United States federal or state privacy statute, and it does not describe enforcement by any other regulator.

What Happened

The Information Regulator published a three-page media statement on 26 October 2026 headed "Information Regulator fines Central Johannesburg TVET College and First National Bank for POPIA contravention". It opens by recording that the Regulator "has issued Enforcement and Infringement Notices" against both bodies for non-compliance with POPIA "and has subsequently imposed administrative fines of R500 000 on CJC and R1 million on FNB".

The two matters reached the same sanction by different statutory routes. One began with complaints from individuals and ended in a finding that a notice had been ignored. The other began with the bank's own breach report and ended in a substantive finding about its security safeguards.

Central Johannesburg TVET College: R500,000

The college was issued with an Enforcement Notice on 22 May 2026. According to the statement, that notice followed findings that the institution had contravened several provisions of POPIA, and those findings in turn followed complaints lodged by three affected individuals whose personal information was unlawfully shared with third parties without legal justification.

The Enforcement Notice directed the college to take corrective action within specified timeframes. The statement lists five directed steps, described as including but not limited to: registering its Information Officer and Deputy Information Officer; issuing an apology to the complainants; developing and submitting a POPIA Compliance Framework; conducting POPIA awareness and training programmes for employees; and taking appropriate disciplinary action against the employee responsible for the unlawful disclosure.

The notice stipulated 120 days. At the end of that period the Regulator received a response from the college addressing the findings and orders in the notice. The statement does not give the calendar date on which the 120 days expired, and we have not derived one.

On considering that response, the Regulator found that the college had failed to comply with the Enforcement Notice. The statement identifies four examples: not reporting the security compromise in a prescribed manner, non-development of the Compliance Framework, delayed issuing of an apology, and not adhering to the stipulated timeframes.

The statement then records the consequence in one sentence:

"These inactions and failures are very serious contraventions of POPIA, and thus the Regulator issued an Infringement Notice with an administrative fine of R500 000 (five hundred thousand rand) against CJC."

Source: Information Regulator of South Africa, media statement of 26 October 2026, page 2.

First National Bank: R1,000,000

The Regulator issued both an Enforcement Notice and an Infringement Notice against FNB following a POPIA compliance assessment conducted in terms of section 89 of POPIA. The statement does not give a date for either notice, and no date should be inferred for them.

The assessment was initiated after FNB submitted a security compromise notification in terms of section 22 of POPIA. That notification itself followed media reports concerning the exposure of customer information and unlawful access to personal information through what the statement calls FNB's digital home loan application platform. The statement records that the exposed information included data subjects' account numbers.

On the Regulator's account, the assessment identified significant shortcomings in FNB's identification, classification and response to repeated security incidents that constituted interference with the confidentiality of personal information, and those findings raised concerns about the adequacy of the bank's technical and organisational measures to protect personal information against unlawful access and other forms of unauthorised processing.

The assessment further identified deficiencies in FNB's implementation of the security safeguards required under section 19 of POPIA, together with weaknesses in its governance frameworks relating to the retention of personal information.

The statement then makes the finding that distinguishes this matter:

"Of regulatory significance, the Regulator found that FNB committed an offence in terms of section 105 of POPIA."

Source: Information Regulator of South Africa, media statement of 26 October 2026, page 2.

The statement ties that finding to FNB's unlawful processing of data subjects' account information through its failure to comply with the security safeguards prescribed by section 19. It records that the Regulator found FNB reasonably ought to have known that there was a risk of such a contravention occurring and that the contravention was likely to cause substantial damage or distress to affected individuals, and that FNB failed to take reasonable steps to prevent it. The Regulator then issued an Infringement Notice against FNB and imposed an administrative fine of R1,000,000.

The statement closes with a general instruction to regulated bodies. The Regulator "calls on public and private bodies to review their compliance programmes, strengthen information-security safeguards, ensure that Information Officers discharge their statutory responsibilities and respond promptly to regulatory directives".

Source: Information Regulator of South Africa, media statement of 26 October 2026, page 2.

What the Law Actually Says

POPIA was assented to on 19 November 2013 and published in Government Gazette No. 37067 on 26 November 2013 as Act No. 4 of 2013. The enforcement machinery in sections 55 to 109 commenced on 1 July 2020. The provisions below are quoted from that gazetted text, which we opened directly rather than relying on the Regulator's summary of it. For the structure of the Act as a whole, including all eight conditions for lawful processing, see our guide to POPIA's eight conditions, rights and penalties.

Section 19: the security safeguards obligation

Section 19 is Condition 7 of Chapter 3. Section 19(1) requires a responsible party to "secure the integrity and confidentiality of personal information in its possession or under its control by taking appropriate, reasonable technical and organisational measures". Those measures must prevent two things, and the Act joins them conjunctively: loss of, damage to or unauthorised destruction of personal information, and unlawful access to or processing of personal information.

Section 19(2) then specifies what giving effect to that duty requires. The responsible party must take reasonable measures to identify all reasonably foreseeable internal and external risks to the information, establish and maintain appropriate safeguards against the risks identified, regularly verify that the safeguards are effectively implemented, and ensure that the safeguards are continually updated in response to new risks or deficiencies in previously implemented safeguards. Section 19(3) adds that the responsible party must have due regard to generally accepted information security practices and procedures, including any required by specific industry or professional rules.

The four limbs of section 19(2) are worth reading against the Regulator's FNB findings. The Regulator's findings touch several of those limbs: identification of risks, the adequacy of the measures themselves, and the verification and updating of safeguards in response to repeated incidents. The statement records both shortcomings in how FNB identified, classified and responded to repeated security incidents and deficiencies in its implementation of the section 19 safeguards.

Section 22: notifying a security compromise

Section 22(1) applies where there are reasonable grounds to believe that the personal information of a data subject has been accessed or acquired by any unauthorised person. The responsible party must then notify two parties, and the Act joins them conjunctively: the Regulator, and the data subject, unless the identity of that data subject cannot be established.

Section 22(2) sets the timing. The notification "must be made as soon as reasonably possible after the discovery of the compromise, taking into account the legitimate needs of law enforcement or any measures reasonably necessary to determine the scope of the compromise and to restore the integrity of the responsible party's information system".

Reporting is therefore mandatory, not optional. Section 73(b) makes non-compliance with section 22 an interference with the protection of a data subject's personal information in its own right, which is the finding that can trigger an Enforcement Notice. The Regulator's statement records that FNB did notify under section 22.

From section 19 to section 105: how the offence finding is built

Section 105 does not operate directly on section 19, and the chain matters. Section 105(1) provides that "a responsible party who contravenes the provisions of section 8 insofar as those provisions relate to the processing of an account number of a data subject is, subject to subsections (2) and (3), guilty of an offence".

Section 8 is Condition 1 of Chapter 3, accountability. It provides that the responsible party "must ensure that the conditions set out in this Chapter, and all the measures that give effect to such conditions, are complied with at the time of the determination of the purpose and means of the processing and during the processing itself". Section 19 is Condition 7 of that same chapter. A security safeguards failure under section 19 is therefore a failure of a Chapter 3 condition, section 8 obliges the responsible party to ensure that condition is met, and section 105 attaches offence consequences to that failure where it relates to an account number.

Section 105 then adds thresholds that are not automatic. Under section 105(2) the contravention must be of a serious or persistent nature, and must be likely to cause substantial damage or distress to the data subject. Both limbs are required. Under section 105(3) the responsible party must have known or ought to have known either that there was a risk the contravention would occur or that it would likely cause substantial damage or distress, and must have failed to take reasonable steps to prevent it. The language in the Regulator's statement about what FNB reasonably ought to have known tracks section 105(3).

The account-number detail in the statement is doing legal work rather than adding colour. Section 105(5) defines "account number" for this purpose as any unique identifier assigned to one data subject only, or jointly to more than one data subject, by a financial or other institution, which enables that data subject to access their own funds or credit facilities, or joint funds or joint credit facilities. A home loan application platform handling customer account numbers falls inside that definition, and without an account number there is no section 105 route at all.

Section 105(4) preserves a defence. On a charge under section 105(1) it is a valid defence to contend that the responsible party took all reasonable steps to comply with section 8. That defence belongs to a criminal court, not to the Infringement Notice stage.

The Regulator's statement does not cite a section for the retention findings. For readers tracing the Act, retention sits in section 14 under Condition 3, purpose specification, which is a different condition from the section 19 security condition.

Enforcement Notices, Infringement Notices and administrative fines

These are three distinct instruments, and the 26 October statement uses all three terms precisely.

An Enforcement Notice is issued under section 95. The Regulator may serve one where, after considering a recommendation of the Enforcement Committee under section 93, it is satisfied that a responsible party has interfered or is interfering with the protection of a data subject's personal information as referred to in section 73. Section 73 defines that interference as any breach of the Chapter 3 conditions, non-compliance with section 22, 54, 69, 70, 71 or 72, or a breach of a code of conduct issued under section 60. The notice may require specified steps within a specified period, or an end to specified processing, or both.

Section 95(2) requires the notice to state the nature of the interference and the reasons for that conclusion, and to set out the rights of appeal conferred by section 97. Under section 97(1), a responsible party served with an information or enforcement notice may appeal to the High Court having jurisdiction within 30 days of receiving it, for the setting aside or variation of the notice. Section 95(3) suspends compliance until the appeal period ends and, if an appeal is brought, pending its determination or withdrawal, unless the Regulator has invoked the urgency provision in section 95(4).

Failing to comply with an Enforcement Notice is itself an offence. Section 103(1) provides that "a responsible party which fails to comply with an enforcement notice served in terms of section 95, is guilty of an offence". That is the provision the college's position engages.

An Infringement Notice is the instrument that carries the money. Section 109(1) provides that "if a responsible party is alleged to have committed an offence in terms of this Act, the Regulator may cause to be delivered by hand to that person (hereinafter referred to as the infringer) an infringement notice". Section 109(2)(c) requires the notice to specify the amount of the administrative fine payable, "which amount may, subject to subsection (10), not exceed R10 million". Section 109(10) allows the Minister, after consultation with the Regulator, to adjust that ceiling by notice in the Gazette in line with the consumer price index. We did not locate a gazetted adjustment, so the R10 million figure is quoted as enacted.

Section 109(3) lists the eight factors the Regulator must consider in setting an amount: the nature of the personal information involved; the duration and extent of the contravention; the number of data subjects affected or potentially affected; whether the contravention raises an issue of public importance; the likelihood of substantial damage or distress, including injury to feelings or anxiety suffered by data subjects; whether the responsible party or a third party could have prevented it; any failure to carry out a risk assessment or to operate good policies, procedures and practices; and whether the responsible party has previously committed an offence under the Act.

An offence finding is not a conviction

This is the point most easily garbled, and the Act is explicit about it.

The offence and the administrative fine are not two separate penalties stacked together. Under section 109(1) an alleged offence is the statutory precondition for issuing an Infringement Notice at all. The offence finding is the gateway; the administrative fine is what the Regulator imposed through that gateway. That is why the statement reports an offence finding and a fine in the same breath for FNB.

What the finding is not is a criminal conviction. Section 109(8) provides that an administrative fine imposed under that section "does not constitute a previous conviction as contemplated in Chapter 27 of the Criminal Procedure Act, 1977 (Act No. 51 of 1977)". Criminal penalties under POPIA attach only on conviction: section 107(a) exposes a person convicted of contravening section 105(1) or section 103(1) to a fine or to imprisonment for a period not exceeding 10 years, or to both. A conviction requires a prosecution before a criminal court, and the Regulator is not one. Section 108 gives a Magistrate's Court jurisdiction to impose the section 107 penalties.

POPIA also keeps the two tracks from running together. The Regulator may not impose an administrative fine where the responsible party has already been charged with an offence under the Act on the same set of facts (section 109(6)), and no prosecution may be instituted once an administrative fine has been paid on the same set of facts (section 109(7)). On these facts a criminal charge becomes live mainly if the responsible party chooses it: under section 109(2)(d)(iii) the infringer may elect to be tried in court, and section 109(4) then requires the Regulator to hand the matter to the South African Police Service and to inform the infringer accordingly.

The 26 October statement does not say that either matter has been referred for prosecution, and nothing in it supports describing either body as convicted or as facing criminal charges as at that date.

For scale, and what has happened when these notices reached a court

The Regulator has announced a larger figure before, and both of the instruments used against FNB and the college have since been tested in court. Neither test left the Regulator's original position intact, which is the context the bare numbers lack.

On 23 December 2024 the Regulator issued an Infringement Notice ordering the Department of Basic Education to pay an administrative fine of R5 million after that department failed to comply with an Enforcement Notice issued on 18 November 2024 concerning publication of the 2024 matric results in newspapers. That statement set out the same 30-day election: pay, arrange instalments, or elect to be tried in court.

That matter did not end there. In a media statement dated 31 December 2025 the Regulator said:

"The Information Regulator (Regulator) has decided to apply for Leave to Appeal following the decision by the full bench of the Pretoria High Court to set aside the Regulator's Enforcement Notice and the Infringement Notice, which was issued to the Department of Basic Education (DBE) in 2024."

Source: Information Regulator of South Africa, media statement of 31 December 2025.

What the court did was set both notices aside. What follows from the appeal is the Regulator's own characterisation and should be read as such: the Regulator said it had filed an appeal "which has the effect of suspending the execution of the orders that are the subject of the appeal, pending the final determination of the application and any subsequent appeals", and that the application for leave to appeal "makes the Enforcement Notice and Infringement Notices enforceable", so that the department must still comply unless it obtains an order granting it leave to execute the judgment. On that account the suspension runs against the setting-aside orders rather than against the notices. We have found no later statement on the outcome of the leave application, so as at 3 November 2026 the position is contested and not final, and the R5 million is a published datapoint on the amounts the Regulator has chosen rather than a fine that has survived judicial scrutiny.

The second test went to the amount itself. In a media statement dated 29 April 2026 the Regulator said it had welcomed an order of the Polokwane High Court in its favour in early April 2026 against Blouberg Local Municipality, following a complaint that personal information relating to a member of staff had been made available on the municipality's website. The Regulator had issued an Enforcement Notice and later an Infringement Notice, and on failure to comply with both it sought court confirmation under section 109(5), which it describes as the process for an administrative fine to be made a court order. The court did not simply confirm the amount:

"The infringement fine imposed on the Blouberg Local Municipality by the Regulator amounted to R500,000, however, the Judge who considered the section 109(5) statement was of the view that the fine was excessive in the circumstances. As such, the Judge concluded that a fine of R250,000 was more reasonable."

Source: Information Regulator of South Africa, media statement of 29 April 2026.

The statement gives three stated considerations for the reduction: that the personal information of one data subject was affected rather than many, that the municipality had taken corrective measures to remove the complainant's information from its website, and that it was the municipality's first POPIA violation. Those map onto factors the Act already lists in section 109(3), namely the number of data subjects affected, whether the contravention could have been prevented, and whether the responsible party has previously committed an offence under the Act. That mapping is our observation; the statement does not cite section 109(3).

The amount reduced in that matter, R500,000, is the same figure the Regulator has now imposed on Central Johannesburg TVET College, although on quite different facts. Measured against the amount the Regulator chose in the Department of Basic Education matter, R500,000 is a tenth and R1,000,000 is a fifth. Section 109(3) supplies the published factors that can account for differences of that kind, and we make no claim about how the Regulator weighted them here, because the statement does not say.

Analysis: Why This Matters

The following is analysis from the Recording Law Editorial Team.

The FNB matter is the more consequential of the two, because of how it started. The college was fined for ignoring a notice, which is a familiar pattern: the Regulator's published Department of Basic Education action in December 2024 took the same shape. The bank was fined on the substance of its security posture, after an assessment under section 89 rather than after any defiance of an order. On the Regulator's own account the Enforcement Notice and the Infringement Notice were both issued following that assessment. A responsible party does not have to disregard a directive first to reach an administrative fine.

That matters because section 89 assessments can be opened on the Regulator's own initiative. Section 89(1) requires the Regulator, on its own initiative or at the request of a responsible party, data subject or any other person, to make an assessment in the prescribed manner of whether an instance of processing of personal information complies with the Act, and section 89(2) makes that duty turn on whether an assessment appears to be appropriate.

The sequence also deserves to be stated plainly rather than turned into a lesson about self-reporting. FNB notified the compromise under section 22, and the assessment followed that notification. It would be wrong to read that as a penalty for reporting. Section 22 notification is mandatory where its trigger is met, section 73(b) makes failure to notify an interference in its own right, and the statement locates the fine in section 19 safeguards and section 105, not in the notification. What the sequence does show is that a section 22 notification is visible to the Regulator and can be the starting point for a wider look at the processing behind it.

The section 105 route is the part of this that is specific to financial institutions and others that issue account identifiers. Two responsible parties can fail at section 19 in materially similar ways, and only the one whose failure touched account numbers as defined in section 105(5) is exposed to the offence finding that opens the section 109 door. On the Regulator's account the exposed data here included account numbers, and the platform was a home loan application platform, which is to say a credit facility context. The definition in section 105(5) reaches both funds access and credit facilities.

Next, the amounts. R500,000 and R1,000,000 are 5 percent and 10 percent of the R10 million ceiling in section 109(2)(c). Readers drawing conclusions about severity should note that section 109(3) makes the amount a multi-factor judgment, including the number of data subjects affected, and that the published statement does not disclose how those factors were weighted. The honest observation is narrower: the ceiling in the Act is now illustrated by real figures at the lower end of its range, and the Regulator chose an administrative fine rather than referring either matter for prosecution.

Finally, and this is what the headline figures conceal: an announced POPIA fine is not the same thing as a fine that has stuck. The Regulator's own published record contains a full bench setting aside both notices in the Department of Basic Education matter, with the setting-aside now itself under appeal, and a High Court judge halving a R500,000 administrative fine to R250,000 on a section 109(5) confirmation. Both concern the same two instruments the Regulator has now used against FNB and the college. That is not a prediction about these two matters, and we make none. It is the published record of what has happened when the Regulator's notices have been judicially examined, and it is the reason to read R500,000 and R1,000,000 as the amounts imposed rather than the amounts finally payable.

How This Affects You

This section is general information about how POPIA works. It is not advice about any particular situation, and nothing here tells any reader what to do about their own.

For a data subject in South Africa, the college matter shows the complaint route working end to end. Section 74(1) provides that any person may submit a complaint to the Regulator in the prescribed manner, and the Regulator's statement traces this Enforcement Notice back to complaints by three affected individuals. Our page on how to complain to the Information Regulator sets out the prescribed form and what follows a complaint.

For a responsible party, the published criteria are the ones to read rather than the headline figures. Section 19(2) lists what giving effect to the security duty requires, section 109(3) lists what the Regulator must weigh in setting a fine, and the 26 October statement asks public and private bodies to review compliance programmes, strengthen information-security safeguards, ensure Information Officers discharge their statutory responsibilities, and respond promptly to regulatory directives.

Anyone who banks with FNB and wants to know whether their own information was involved should note what the public record does and does not contain. The Regulator's statement describes categories of exposed information, including account numbers, but it does not identify affected individuals or state how many there were. Section 22(1) places the duty to notify affected data subjects on the responsible party, and section 22(5) sets out what such a notification must contain, including a description of the possible consequences and of the measures taken to address the compromise. Broader context on the Act sits in our overview of South Africa's data protection framework and our country guide to POPIA.

What Happens Next

Three statutory clocks are now relevant, and the public record does not let any of them be dated precisely.

Under section 109(2)(d), each body has 30 days from the date of service of its Infringement Notice to pay the administrative fine, to make arrangements with the Regulator to pay in instalments, or to elect to be tried in court on a charge of having committed the alleged offence. The 26 October statement gives no service date for either notice, so neither window can be fixed from what has been published.

If either body elects to be tried, section 109(4) requires the Regulator to hand the matter to the South African Police Service and to inform the infringer. If an Infringement Notice is not complied with, section 109(5) allows the Regulator to file a certified statement of the amount payable with the clerk or registrar of a competent court, and that statement then has the effect of a civil judgment for a liquid debt in the Regulator's favour. What a court does with such a statement is not automatic. In the section 109(5) confirmation the Regulator announced in April 2026, set out above, the judge who considered the certified statement regarded the R500,000 fine as excessive in the circumstances and concluded that R250,000 was more reasonable. Any fine paid goes into the National Revenue Fund under section 109(9).

Separately, the Enforcement Notices are appealable. Section 97(1) gives a responsible party 30 days from receiving such a notice to appeal to the High Court for its setting aside or variation, and section 98 sets out what the court may do on appeal, including allowing the appeal where the notice was not in accordance with the law or involved a discretion that ought to have been exercised differently. The college's Enforcement Notice was issued on 22 May 2026, so any appeal period on that notice has long run; no date is published for FNB's.

The statement is silent on whether either body will pay, challenge, or elect trial, and it gives no payment dates. We do not know, and we will not guess. The events that would convert this into hard news are a filed High Court appeal, an election to be tried in court with a referral to the South African Police Service, confirmed payment, a section 109(5) filing, or a further statement from the Regulator. We are monitoring the Regulator's media-statements index for all of them.

This article is general legal information about South African data protection law, not legal advice. It does not create a lawyer and client relationship, and it is not a substitute for advice from a qualified legal practitioner admitted in South Africa about your own circumstances.

Related articles

• POPIA explained: the eight conditions, your rights and penalties
• How to complain to the Information Regulator
• South Africa data protection law
• South Africa data privacy laws: the POPIA guide

Last updated: 2026-11-03. This is a developing story; details verified as of 2026-11-03.

Frequently Asked Questions

How much were FNB and Central Johannesburg TVET College fined under POPIA?

In a media statement dated 26 October 2026, South Africa's Information Regulator said it had imposed an administrative fine of R500,000 on Central Johannesburg TVET College and R1,000,000 on First National Bank, in each case by Infringement Notice, for contraventions of the Protection of Personal Information Act 4 of 2013.

Does the finding that FNB committed an offence mean the bank has been convicted of a crime?

No. The Regulator is not a criminal court. Under section 109(1) of POPIA an alleged offence is the precondition for issuing an Infringement Notice, and section 109(8) states that an administrative fine imposed under that section does not constitute a previous conviction as contemplated in Chapter 27 of the Criminal Procedure Act, 1977. Criminal penalties under section 107 attach only on conviction. The 26 October 2026 statement does not say that any prosecution has been instituted.

What is the maximum administrative fine the Information Regulator can impose under POPIA?

Section 109(2)(c) of POPIA says the amount specified in an Infringement Notice may not exceed R10 million, subject to section 109(10), which lets the Minister adjust that ceiling by notice in the Gazette in line with the consumer price index. We did not locate a gazetted adjustment, so R10 million is the figure as enacted. The R500,000 and R1,000,000 fines announced on 26 October 2026 sit at 5 percent and 10 percent of that ceiling.

Why did the Regulator rely on section 105, which deals with account numbers?

Section 105(1) of POPIA makes it an offence for a responsible party to contravene section 8 insofar as it relates to processing a data subject's account number, where the thresholds in section 105(2) and (3) are met. Section 105(5) defines an account number as a unique identifier assigned by a financial or other institution that enables access to funds or credit facilities. The Regulator's statement records that the information exposed through FNB's digital home loan application platform included data subjects' account numbers, and ties the offence finding to FNB's failure to comply with the security safeguards prescribed by section 19.

Can FNB or the college challenge these POPIA fines?

POPIA provides routes, and the 26 October 2026 statement does not say whether either body is using any of them. Under section 109(2)(d) an infringer has 30 days from service of an Infringement Notice to pay, to arrange instalments, or to elect to be tried in court, and section 109(4) then requires the Regulator to hand the matter to the South African Police Service. Separately, section 97(1) allows a responsible party to appeal an Enforcement Notice to the High Court within 30 days of receiving it. No service dates were published, so the windows cannot be dated from the public record.

Was FNB fined for reporting its own data breach?

No. The Regulator's statement says the section 89 compliance assessment was initiated after FNB submitted a security compromise notification under section 22 of POPIA, but it locates the fine in deficiencies in FNB's section 19 security safeguards and in the section 105 offence finding, not in the notification. Notification is mandatory under section 22(1) where its trigger is met, and section 73(b) of POPIA makes failure to notify an interference with the protection of personal information in its own right.

Have POPIA administrative fines held up in court?

The Information Regulator's published record is mixed, and both outcomes concern the same instruments used here. In a media statement dated 31 December 2025 the Regulator said a full bench of the Pretoria High Court had set aside both the Enforcement Notice and the Infringement Notice it issued to the Department of Basic Education in 2024, and that it had decided to apply for leave to appeal; on the Regulator's account the filing suspends execution of the setting-aside orders, so the notices remain enforceable pending final determination. In a media statement dated 29 April 2026, on Blouberg Local Municipality, the Regulator said the judge who considered its section 109(5) certified statement regarded the R500,000 fine as excessive and concluded that R250,000 was more reasonable. An announced amount is therefore not necessarily the final amount.

What did the Enforcement Notice require Central Johannesburg TVET College to do?

According to the Regulator's 26 October 2026 statement, the Enforcement Notice of 22 May 2026 directed the college to take corrective action within specified timeframes, including but not limited to registering its Information Officer and Deputy Information Officer, issuing an apology to the complainants, developing and submitting a POPIA Compliance Framework, conducting POPIA awareness and training programmes for employees, and taking appropriate disciplinary action against the employee responsible for the unlawful disclosure. The notice stipulated 120 days.