Israel PPL

No changes recorded yet — we are watching, and nothing has been published.

1. 2025-08-14 Amendment No. 13 enters into force, including the DPO duty and monetary sanctions
2. 2024-08-05 Knesset approves Amendment No. 13 to the Protection of Privacy Law
3. 2023-05-07 Privacy Protection Regulations on data transferred to Israel from the European Economic Area (5783-2023) published in the official gazette (Reshumot)

1. 2024-08-05
   Amendment No. 13 (5784-2024) AmendmentCurrent text

   The most comprehensive overhaul of Israeli privacy law since 1981, approved by the Knesset on 5 August 2024 and in force since 14 August 2025. source

   More

   • It updated the core definitions (personal data, and "data of special sensitivity" replacing the earlier "sensitive information"), significantly narrowed database registration (now data brokers and public bodies, plus a notification duty for large databases of especially sensitive data), introduced for the first time a duty to appoint a data protection officer, extended the Authority's supervision and administrative inquiry powers, gave it power to impose monetary sanctions, and widened compensation without proof of damage.
2. —
   Protection of Privacy Law, 5741-1981 Major version

   The original statute: privacy infringement as a civil wrong and a criminal offence, plus the database chapter. source

Chapter B applies to anyone who controls or processes a database of personal data in digital form.

Privacy infringement

Chapter A protects everyone against privacy infringements such as surveillance, publishing private matters or using information for a purpose other than the one it was given for. source

Contact lists

A contact-only list of up to 100,000 people is not a database only if it reveals nothing more about them and its owner holds no other collection with further details on the same people. source

Registration

Registration with the Authority is required only for databases whose main purpose is selling or supplying data (over 10,000 people) and for most public-body databases. source source

Notification

Other controllers holding data of special sensitivity on more than 100,000 people must notify the Authority instead. source source

Special sensitivity

"Data of special sensitivity" covers intimate and family life and sexual orientation, health and medical data, genetic data, biometric identifiers, ethnic origin, criminal record, political or religious views, personality assessments, location and communication data, salary and financial activity, and data confidential by law. source

Controllers comply on their own.

Certification

There is no certification. source

Registration

Register or notify the database where Article 8A requires it. source

Data security

Keep a database definitions document and meet the Privacy Protection (Data Security) Regulations, 5777-2017, which set basic, medium and high security levels by database type. source source

Data protection officer

Appoint a data protection officer where Article 17B1 requires one - public bodies, data brokers with over 10,000 people, and organisations whose core activity is large-scale systematic monitoring or large-scale processing of especially sensitive data (for example banks, insurers, hospitals, health funds, mobile operators and search engines). source source

Data security officer

Bodies with five or more registrable databases, public bodies, banks, insurers and credit rating firms also need a data security officer. source

Preliminary opinion

A controller may ask the Authority for a preliminary opinion on compliance, due within 60 days (Article 17I2). source

Since Amendment 13 the Head of the Privacy Protection Authority can impose fixed monetary sanctions (Article 23KF).

Continuing violations

Continuing violations add 1% per day. source

Reductions

Sanctions are reduced for micro and small enterprises and capped at 5% of turnover on request. source

Publication

Every sanction is published on the Authority's website. source

Inspection

Authority inspectors can demand information, documents and computer material and enter premises where a database is kept (a residence only by court order). source

Criminal offence

Wilful privacy infringement is a crime punishable by up to five years' imprisonment. source

Court damages

Courts can award statutory damages of up to NIS 50,000, index-linked (double where intent to harm is proven), and up to NIS 10,000 without proof of damage for specific database breaches such as refusing access or running an unregistered registrable database. source

1. Law text Privacy Protection Law, 5741-1981 - unofficial English translation updated after Amendment 13 (Privacy Protection Authority)
2. Guidance Privacy Protection Authority position paper on appointing a DPO under Amendment 13 (Hebrew, 14 July 2026)
3. Guidance Privacy Protection Authority professional guide to Amendment 13 (Hebrew, May 2025)
4. Law text Protection of Privacy Law on the Knesset legislation database (Hebrew)

1. GDPR

   The EU regulation, with turnover-based fines up to 4% and no database registration; the EU has recognised Israel as giving adequate protection for data transferred from the EU.

2. Israel CDMO 2.0

   The Israel National Cyber Directorate's cyber defence methodology for organisations - a security control framework, not a privacy statute enforced by the Privacy Protection Authority.

Verified against official sources on 17 October 2026. We monitor the official sources for this framework. Watching since 20 September 2026. Subscribe to Israel PPL (RSS)