How Data Fines Get Priced Into the Cost of Business?
2 Min Read
The Information Regulator has fined FNB R1 million under POPIA. The findings cover four separate failures: an app glitch that let 696 customers see the home loan applications of 88 other people, the way the bank processed account numbers, collecting information on prominent people from newspapers and online searches, and keeping some records indefinitely without a stated reason.
FNB's own earnings for the year to June were R26.44 billion, so that works out to roughly R3 million an hour, meaning the fine is about twenty minutes of profit… not a very big knock
If the fine is that small, why would anyone pay more to comply than to get caught? More on that below.
P.S. We have a resource hub with articles programmes, bursaries, VAC work and other resources. Access it here 👇
🧠 Fun fact: The world's first data protection law was passed by the German state of Hesse in 1970.
Wall Street Oasis' Elite Modeling & Valuation Certification: six courses covering Excel, financial statements, DCF, valuation, M&A and LBO. 100+ lessons, self-paced → Start the certification
What FNB Got Wrong
The glitch on the app is pretty straightforward, some customers were tagged with employee-level access, and the app did exactly what employee access is supposed to do.
The newspaper finding is worth more of a conversation. Under the FIC Act, banks have to identify domestic prominent influential persons and apply enhanced due diligence to them. So FNB was screening these people because law told it to. The Regulator's view is that POPIA lets you collect personal information from a "public record", not a "public source", and a newspaper according to them isn't a public record.
That leaves the bank answering to two statutes which seem to be somewhat contradictory.
The last non-compliance, on the record/data retention finding is simple. The Regulator said FNB's retention schedule didn't state a legal basis for keeping certain records, and FNB couldn't sufficiently explain one either.
FNB has 30 days to pay or to elect to be tried in court. We couldn't find a public response from the bank. Until it either pays or goes to court, these are the Regulator's findings, not a verdict.
(But we’re not too worried about the outcome for this newsletter post)
Why The Regulation Rulebook Is Getting Thicker
Now that everything is searchable, almost any fact about a person feels public, and POPIA has to draw the line somewhere more precise than "Google found it". Every one of those precise lines is a new compliance judgement that needs to be made by someone.
Cyber risk adds another layer, because breaches increasingly come in through someone else's systems. IBM's 2025 Cost of a Data Breach report puts third-party and supply-chain compromise as the leading cause of South African breaches, at 17% of incidents. So the rules now reach into supplier contracts too.
Banks also sit under the Prudential Authority and FSCA's Joint Standard 2 on cyber resilience. Each regulator writes for its own risk, which means that the compliance cost lands mainly where rules overlap.
IBM puts the average South African breach at R44.1 million, and at R70.2 million in financial services.
So the cheapest part of compliance is actually before you collect anything:
→ Collect less in the first place (POPIA s10).
→ Write the legal basis next to every line of the retention schedule, which is the exact column FNB was missing.
→ Re-test access permissions whenever roles change.
→ Put operator contracts in place before a supplier ever touches your data.
Is It Cheaper to Just Pay the Fine?
Here's the cynic's case.
POPIA caps an administrative fine at a flat amount of R10 million. For FNB, that's a little over three hours of earnings. GDPR caps fines at 4% of global turnover precisely so that this sum can't come out in the company's favour.
Since the first fine in 2023, the Regulator has issued roughly half a dozen. The two biggest were R5 million each, and a court set one of those aside. At least two of the smaller ones are still unpaid. Expected cost is the chance of being caught multiplied by the fine, and both numbers are small.
On paper, the cynic has a point, but a chartered accountant will see four places where the sum might not add up:
1. The fine is paid with after-tax money: Section 23(o)(ii) of the Income Tax Act blocks any deduction for a fine imposed for unlawful activity. However, compliance spend is generally deductible. At 27%, a R1 million fine costs the same as roughly R1.37 million of compliance spend before tax.
2. The data isn’t on the balance sheet: IAS 38 doesn't let you recognise internally generated customer lists as intangible assets. The value you broke the rule for stays invisible, while the fine shows up as a liability under IAS 37. The benefit stays off the balance sheet and the cost goes on it.
3. The fine is usually the smallest cost: IBM's R44.1 million average is built from detection, lost business, post-breach response and notification. Notification alone averages R950,000, which is nearly FNB's entire fine.
4. The price goes up the second time: When setting a fine, the Regulator is required to consider whether you've committed an offence before.
To be clear, nothing in the findings suggests FNB made this cost vs benefit calculation. But the calculation is real, and boards will definitely run it.
Insights From The Pocket CA
We've partnered with Pocket CA, an AI tool built for accountants, like your friend if they actually listened in lecture.
Here’s the technical detail in this scenario from the number-crunching machine:
Fines are the textbook provision (IAS 37.14 and .19): IAS 37.19 uses "penalties" for unlawful damage as its own example of an obligation that exists regardless of what the entity does next. Once the breach has happened, the obligating event is in the past.
When you contest it (IAS 37.16): If FNB elects to go to court, the question becomes whether a present obligation is more likely than not, judged on all available evidence including legal opinions. If it isn't, the fine becomes a contingent liability rather than a provision.
The prejudice exemption (IAS 37.92): In "extremely rare" cases, detailed disclosure can be withheld if it would seriously prejudice the entity in the dispute. You still have to disclose the general nature of the dispute, and why you've held the rest back.
The data can't be an asset (IAS 38.63, .64 and .16): Internally generated customer lists are never recognised, because their cost can't be separated from building the business as a whole. Customer relationships usually fail the control test unless legal rights protect them.
Timing (IAS 10.9(a)): If a case settles after year end and confirms an obligation that already existed at year end, that's an adjusting event. You recognise or update the provision. A contingent liability note isn't enough.
The auditor's lens (ISA 250.6(b), .7, .15 and A18): For most entities, POPIA is an "other" law, so the auditor's duty is limited to specified procedures. These include inquiring of management and inspecting correspondence with regulators. ISA 250.A18 lists regulatory investigations and fines as indicators of non-compliance in their own right.
The tax angle (s23(o)): No deduction for a fine imposed for unlawful activity. Before the rule was written into the Act, ITC 1490 had already disallowed a transport company's overloading fines, partly because a deduction would lighten the punishment.
Check out the → 🔗Pocket CA
Where King V Comes In
King V's Principle 10 says the board governs data, information and technology. Therefore the board is accountable for managing data "including acquisition, creation, use, dissemination and disposal". FNB's findings sit at both ends of that list: what it collected and what it never threw away.
Principle 9 asks boards to take "a holistic perspective on the interrelation between applicable laws". The FIC Act and POPIA pulling in opposite directions is that practice in action.
FirstRand's financial year starts on 1 July, so its first King V year began on 1 July 2026. This fine lands in it.
The Bottom Line
Treating a fine as a cost of doing business only works if the fine is the only cost. The breach itself costs several times the maximum penalty, and the penalty is the one line SARS won't let you deduct.
If you're in articles, ask your client for their retention schedule and check whether each category has a legal basis written next to it.
P.S. we’re not encouraging any non-compliance, we’re just interested in the psyche behind it.
Poll: The fine for breaking a data rule is cheaper than complying with it. What should the board do? (Reply with your number)
Comply anyway
Pay the fine and move on
Depends on the odds of getting caught
Until next week,
The Journal Entry Team
If you enjoy our content we’d love it if you showed your friends and peers!
Please copy and paste this link to others:
