Late last month, the Information Regulator fined a major South African bank R1 million. A misconfigured setting in its mobile app had let 696 customers view the home loan applications of 88 other people, including contact details, addresses, income information and, in some cases, account numbers.
The flaw is the least interesting part. What stands out is what happened when customers noticed it.
Two reports, one classification
A customer told the bank about the problem on 30 March 2022. A second customer reported the same problem on 3 May 2022. According to the enforcement notice, the bank removed each customer’s access, treated each report as an isolated incident rather than a compromise of personal information, and did not report either to the Regulator. The Regulator only became involved after a complaint reached it in September 2022. It called the bank’s handling “lackadaisical.”
The fine arrived in October 2026, more than four years after the first report.
Our view: the decision that failed was triage, not technology
Someone looked at a customer saying they could see other people’s applications and filed it as a support matter. That took minutes. It shaped everything that followed.
POPIA’s section 22 duty arises when you have reasonable grounds to believe an unauthorised person has accessed or acquired personal information. It does not wait for confirmation of scale or cause. A customer who can open a stranger’s application is a strong candidate for that threshold. Whether the incident process starts at all depends on how the first report is classified, and that classification is rarely documented, owned or reviewed.
We would change three things in any organisation that holds personal information:
Route by default. Any report from a customer or employee of seeing data they should not see enters the incident process first. It is downgraded only after an assessment, never before.
Treat repeats as a signal. A second report of the same flaw should trigger root-cause analysis. Fixing it for the second person individually is not a response.
Record every “isolated” decision. Who made the call, on what evidence, and who approved it. If that record cannot be produced, the decision will look careless to a regulator even if it was reasonable.
The investigation did not stop at the incident
The notice went well beyond the app. The Regulator found the bank could not lawfully justify collecting personal information from newspapers under the provision it relied on, a practice used mainly to screen politically exposed persons. It found the retention schedule let some records, including cancelled employee tax certificates, be kept indefinitely with no stated legal basis. And it found the privacy notice relied on grounds that are not valid exceptions for further processing and did not set out all customers’ rights.
The bank must now document a lawful basis or stop the collection, destroy certain records and provide a certificate of destruction, amend its privacy notice, and report back within 90 days.
In our view this is the part boards should read twice. An investigation into one incident became a review of lawful basis, retention and transparency across the organisation. An organisation that is only prepared for the incident is not prepared for the inquiry that follows it.
A fair note on the other side
The bank says remediation is complete, that no customers suffered financial harm, and that it has spent three years strengthening its systems, governance and training. That may well be so, and it does not contradict the finding. The Regulator’s concern is how the first two reports were handled in 2022, and how long the exposure might have lasted without outside intervention.
Regulatory processes are slow. Their memory is long.
The report filed as isolated is the one that gets quoted back to you four years later.
