Back

Privacy notice

 
Last updated: September 2026

 

You can download the privacy notice here. 
 
 

Introduction

Nedbank treats personal information with the utmost discretion, adhering to all relevant privacy legislation in the jurisdictions where we operate.
 

In South Africa, this commitment is rooted in the Constitution of the Republic of South Africa, 1996, which protects the right to privacy and is further supported by the Protection of Personal Information Act, 4 of 2013 (POPIA).


We conform to all applicable African Union and European Union privacy and data protection laws that govern the collection and handling of personal information.


These laws collectively strengthen our resolve to protect our clients’ and stakeholders’ personal information, ensuring fair, transparent, and secure use in accordance with global best practices. Personal information, as defined by these laws, includes any data that can be used to identify you as an individual and, where applicable, a legal entity.


This Privacy Notice sets out how we will use your personal information, which applies to any personal information, including any special personal information, that you give us or that we may receive from authorised third parties.


It is important that you read this Privacy Notice carefully before you give us any personal information.


By submitting any personal information to us, you provide consent to the processing of your personal information as set out in this Privacy Notice and the detailed terms and conditions for the relevant Nedbank products and services that you use.


The provisions of this Privacy Notice are subject to mandatory, unchangeable provisions of applicable laws.


Please do not submit any personal information to us if you do not agree to any of the provisions of this Privacy Notice. If you do not consent to the provisions of this Privacy Notice, or parts of the Privacy Notice, we may not be able to provide our products and services to you.

 

What is personal information?

Personal information is data that can be used to identify you. This information includes, but is not limited to, the following:  

  • gender (which we may need for statistical purposes or by law);
  • marital status;
  • nationality or social origin;
  • age;
  • physical or mental health and well-being;
  • disability;
  • religion, conscience, belief, personal opinions or views;
  • culture;
  • language;
  • education;
  • medical conditions;
  • financial information (such as your income and expenses, credit history, investments, assets, affordability and your financial needs);
  • any number or symbol that could identify you (such as account, identity or passport numbers);
  • email address, physical address or phone number (which we may need to communicate with you);
  • location and online identifiers, such as your internet protocol (IP) addresses or geolocations;
  • employment history (this is specifically relevant when you apply for credit); and
  • biometric information (e.g. fingerprints and facial or voice recognition).


There may be circumstances in which we will collect your special personal information. Such information may include:

  • race or ethnicity (as required by law and for statistical purposes);
  • health (e.g. when you apply for life insurance);
  • biometric-related information where specifically required;
  • criminal behaviour where it relates to the alleged commission of any offence; or
  • proceedings about any offence allegedly committed by you, or the disposal of such proceedings.
     

The processing of your special personal information will happen only with your consent, unless this is necessary to establish, exercise or defend a right or obligation in law; to comply with a law; for historical, statistical or research purposes; or if it is otherwise lawful to do so.  

 

Aim and objective of this privacy notice

This Privacy Notice aims to provide you and our stakeholders with guidance on how we collect, use and protect personal information. The Privacy Notice sets out:

  • why we collect your personal information and how we may process it;
  • how we share your personal information with third parties;
  • how we protect your personal information;
  • how long we hold onto your personal information; and
  • what your rights are.

 

Why do we process your personal information?

For us to offer you financial products and services, we need to process (i.e. collect, use, share and store) personal and financial information about you so that we can: 

  • assess the risk of fraud, money laundering and the like;
  • enter into banker–client or banker–third party relationships with you;
  • contractually engage with you about credit or any other related banking and insurance services;
  • gain an understanding of your financial needs to offer you the best services and products, including the use of artificial intelligence tools;
  • develop suitable products and services to meet your needs;
  • to continually improve our products and services to meet your needs;
  • market relevant products and services to you;
  • conduct market research and client satisfaction surveys;
  • search, update or place your records at credit bureaus and government agencies;
  • verify your identity;
  • assess your ability to get credit or to give collateral of any kind, including guarantees or suretyships;
  • record and monitor any communication between you and us and use these recordings to verify your instructions to us to analyse, assess and improve our services to clients, and for training and quality purposes; and
  • communicate with you by phone, SMS, email and other electronic media – including our ATMs, mobile application, or Online Banking services – about products that may be of interest to you.
     

It is your right to refuse to provide personal information, but this refusal may limit our ability to provide the required financial products and services to you. We will collect from you only personal information that is necessary and relevant to the service or product we provide.


We will collect and use your personal information only if we are lawfully permitted to do so.


We may send you direct marketing, but you can unsubscribe by opting out on the relevant Nedbank platform (such as Online Banking or the Money app) or advising us directly via the Nedbank Contact Centre.


If we use third-party data providers, we will ensure that they are lawfully allowed to share the information with us.


The lawful bases we rely on for processing this information are that:

  • we have your consent to do so;
  • we have an obligation to carry out actions for the conclusion or performance of a contract with you;
  • we are required by law to process your personal information;
  • the processing is necessary to protect your legitimate interests;
  • we have a legitimate interest to pursue; and/or
  • a third party has a legitimate interest to pursue.

 

Processing personal information of children

We will process the personal information of a child only with the consent of a parent or legal guardian or if we are lawfully allowed to do so.  


We may, for example, process the personal information of a child of 16 years or older if they want to be a depositor with us as authorised by the Banks Act, 94 of 1990.

 

How do we collect your personal information?

We collect your personal information in the following ways: 

  • Directly from you when you complete a product application form, unless:
    • the information is in the public domain;
    • you have consented to our collecting the information from another source;
    • collecting the information directly from you will prejudice the lawful basis for collecting the information; and/or
    • collecting the information directly from you is not reasonably practical.
  • Indirectly from you when you interact with us electronically, i.e. through cookies (refer to details below).
  • From other sources, such as public databases, data aggregators, third parties, as well as other financial institutions, credit bureaus and fraud prevention agencies.
  • Indirectly through your interactions with third parties in a manner that does not prejudice your legitimate interests and/or when it is necessary to collect the information from these third parties.
  • Through agents or third parties who collect personal information on our behalf.
  • Through other entities, divisions or clusters in Nedbank Group.


Third parties from which we may collect your personal information may include

  • law firms; 
  • other financial institutions and service providers; 
  • data brokers; 
  • business partners; 
  • insurance companies; 
  • credit bureaus; 
  • social media;
  • the South African Police Service;
  • local or foreign regulators;
  • public or government entities;
  • Southern African Fraud Prevention Service;
  • Payments Association of South Africa;
  • media publications; and
  • tracing agents.

 

To whom will we disclose your personal information?

Protecting our interests or that of the public may sometimes require the disclosure of specific personal information to third parties, for example if payment failed due to insufficient funds in an account.


Entities and third parties with whom we may share your information may include:

  • banks and financial institutions;
  • regulatory authorities;
  • industry bodies and the ombudsman;
  • law firms and auditors;
  • insurers;
  • the South African Police Service;
  • Southern African Fraud Prevention Service; and
  • other third parties as may be required either contractually, by law, or legitimate interest.


When sharing your personal information with recipients in other jurisdictions, we will ensure compliance with applicable laws.


We will never sell your personal information to third parties and will market to you only in compliance with applicable laws and your marketing preference, using, where reasonably practicable, the communication method you chose.


When we correct, destroy or delete your information, we will, if reasonably practicable, inform each third party to whom the personal information has been disclosed.

 

How do we protect your personal information?

We are committed to ensuring that your information is secure. To prevent unauthorised access to your personal information or its disclosure, we have put reasonable physical, electronic and managerial procedures and systems in place to safeguard and secure the information we collect.


All online transacting sessions are encrypted, and personal information is stored according to internationally accepted banking information security practices.


All breaches are reported to appropriate senior management committees, including the board and executive committee.


All employees (including executives) must complete mandatory privacy training. The Privacy Office also conducts regular awareness sessions across Nedbank Group where privacy requirements are practically presented both virtually and in-person. Additionally, regular privacy awareness campaigns run together with other specialist areas, like cyber or forensics.


When information is shared with third parties that perform certain processing on our behalf, a comprehensive assessment is concluded before sharing of any information. Third parties that already process personal data are subjected to regular monitoring to ensure that their control environment continues to align with the minimum standards required by us.

 

How long will we keep your personal information?

We will keep your personal information for only as long as we need it for a lawful business purpose or as required by law (including tax legislation).


If we need to keep your personal information for longer than required – specifically for historical, statistical or research purposes – we will do so with the appropriate safeguards in place to prevent the records from being used for any other purpose.


Your personal information may be kept for varying periods after the end of our relationship, depending on regulatory requirements or legitimate business requirements. We will take all reasonable steps to destroy or de-identify the personal information that we hold when it is no longer required.


We will restrict processing of your personal information if it is not accurate, no longer needed for the purpose for which we collected it, unlawfully processed and you oppose its destruction or deletion and request that its use be restricted instead, or if you have asked us to transfer the information to another automated processing system. We will inform you before lifting the restriction on the processing of your information.

 

Your data protection rights

You have the right to ask us to confirm whether we hold any information about you. You may also request a record of the personal information we hold about you, as well as information about third parties with whom we have shared your personal information. Once we have given the information to you, you may ask us to:

  • be notified when your personal information is being collected;
  • withdraw your consent for us to process your personal information at any time, on condition that it does not affect the lawful basis on which     we processed the information before your withdrawal, or our legitimate interest or that of a third party;
  • be notified when your personal information has been accessed by an unauthorised third party;
  • correct or delete the personal information in our possession or under our control if it is inaccurate, irrelevant, excessive, out of date, incomplete or misleading, or has been obtained unlawfully;
  • destroy or delete a record of your personal information that we are no longer authorised to keep in terms of regulatory requirements;
  • object at any time to the processing of your personal information where the processing is based on your, our or a third party's legitimate interest, and we will no longer process your information;
  • not rely solely (for decisions) on the basis of the automated processing of your personal information; or
  • stop or start sending you marketing messages by informing us in writing or through our branch network, call centres or website.


You will be informed of the outcomes of any objections or withdrawals we receive from you to process your personal information and confirmation of any corrections made.


You may submit a complaint to the Information Regulator regarding any interference with the protection of your personal information by visiting its website (inforegulator.org.za).


If you want to verify the information we hold about you, or want us to update, change or delete it, you may:

  • refer to our Promotion of Access to Information Manual on nedbank.co.za;
  • call the Nedbank Contact Centre on 0860 555 111; or
  • go to a Nedbank branch.

 

Cookies

Cookies are very small text files that may be stored on your computer or mobile device when you visit a website, enable images, or click on a link in an email. We use cookies to identify which pages are used most often. This helps us analyse data about webpage traffic to improve our website and give you a better user experience.


We use this information for statistical analysis only, after which the data is then removed from the system. We do not record your internet usage after you have left our website.


Cookies help improve the functionality of our website and your experience across our online channels.  


We want to be transparent about our cookie usage, so here's how we handle them:

1. Strictly necessary cookies
These cookies are necessary for our website to function properly on your device. They let you use the website and its features and cannot be switched off.
 

2. Performance cookies

  • These cookies collect anonymous information about how you use our website. They help us improve the performance of our website without collecting personal information.
  • Temporary session cookies exist only while you browse our website. They remember your activities during the session and are deleted when you leave our website or close your browser.


    3. Marketing cookies (advertising cookies)
  • These cookies help us show you advertisements that are relevant to you. We measure the effectiveness of our advertising campaigns based on your interaction with these ads.
  • These cookies stay on your device until they reach their set expiry date or until you delete them. They remember your preferences and choices across visits and help show advertisements relevant to your online activity.


You can manage your cookie settings in your internet browser. Most web and mobile browsers automatically accept them. You can modify your browser settings to manage cookies. However, this may prevent you from taking full advantage of our website experience. Your cookie settings will also affect other websites you visit.


You can manage your cookie settings as follows:

1. Desktop or laptop browser

1.1 Microsoft Edge

- Click the 3 dots (⋯) in the upper right-hand corner of your browser.

- Choose Settings > View advanced settings > Cookies and select Don't block cookies.

- You may need to restart Microsoft Edge for the changes to take effect.
 

1.2 Google Chrome

- Click on the 3-dot menu in the upper right-hand corner.

- Click Settings > Privacy > Cookies.

- Select 1 of these options: Enabled, Enabled excluding 3rd party, or Disabled.

- To erase all cookies, select Clear private data on exit and select Cookies and active logins.

 

2. Mobile device (iOS or Android)

2.1 iOS (Safari)

- Open Settings.

- Scroll down and tap Safari.

- Under Privacy and security, select Block all cookies or Allow from websites I visit.
 

2.2 Android (Chrome)

- Open the Chrome app.

- Tap the 3-dot menu in the upper right-hand corner.

- Go to Settings > Site settings > Cookies.

- Choose your preferred option: Allow all cookies, Block 3rd-party cookies or Block all cookies.

 

Complaints

To submit a complaint about the processing of your personal information, call us on 0860 555 111 or email privacy@nedbank.co.za.


If you are not satisfied with the way we have dealt with your complaint, you can lodge a complaint directly with the Information Regulator through their portal (inforegulator.org.za).

 

Our contact details

The contact details of the information and deputy information officers are: 

 

Information Officer: 

Nomonde Hlongwa 

 

Deputy Information Officer: 

Neelesh Mooljee 

 

Physical address:  

Nedbank 135 Rivonia Campus
135 Rivonia Road
Sandown
Sandton  
Johannesburg  

 

Postal address:  

PO Box 653640
Benmore Gardens  
2196  

 

Email: privacy@nedbank.co.za  

 

Website: nedbank.co.za 

 

About us

Nedbank Group is incorporated in the Republic of South Africa, and our registration number is 1966/010630/06. Our ordinary shares have been listed on JSE Limited (the JSE) since 1969 under the share code NED, and on the Namibian Stock Exchange since 2007 under the share code NBK. Our ISIN is ZAE000004875.


We offer a wide range of wholesale and retail banking services, as well as a growing insurance, asset management and wealth management offering.


These services are offered via frontline clusters:

  • Nedbank Corporate and Investment Banking  
  • Nedbank Personal and Private Banking  
  • NedbankBusiness and Commercial Banking  
  • Nedbank Africa Regions 

 

Our presence

  • Nedbank Group's primary market is South Africa, but we are continuing to expand into the rest of Africa.
  • We have a presence in 5 countries in the Southern African Development Community (SADC) and East Africa region, with subsidiaries and banks in Namibia, Eswatini, Mozambique, Lesotho and Zimbabwe, as well as representative offices in Angola and Kenya.    


Outside of Africa, we have a presence in key global financial centres to provide international financial services to Africa-based multinational and high-net-worth clients. These include the following: 

  • Isle of Man 
  • London 


We also have a representative office in Dubai.