Israel Privacy & Data Protection Laws

Amendment 13 is the most significant overhaul of Israeli privacy law since 1981 and took effect August 14, 2025. It modernizes the definitions — personal data now expressly covers online identifiers, IP addresses and geolocation, and a redefined 'especially sensitive data' category captures biometric, genetic, criminal-record, sexual-orientation and financial information — and rebuilds enforcement, giving the Privacy Protection Authority substantially expanded investigative powers and a turnover-scaled administrative fine regime in place of the previous largely criminal model. It also mandates Data Protection Officers for public bodies, data brokers, and controllers processing especially sensitive data at scale, and adds specific duties for data brokers. On reach: the PPA's position is that the Law extends to databases holding data about people in Israel even without a local establishment, and the Israeli database-registration regime has been narrowed but not eliminated. Israel holds an EU adequacy decision, which the Amendment was partly designed to preserve. The extraterritorial triggers below reflect regulator position rather than an express statutory Article-3 clause — confirm with Israeli counsel for a specific business.

The duty comes from a dedicated 2001 regulation rather than from the Law. Reg. 2's baseline is that data may be transferred out of Israel only where the destination country's law ensures a level of protection at least equal to Israeli law — with a set of alternative grounds, the most used being reg. 2(4): the recipient is bound by agreement with the Israeli database owner to comply with the conditions governing the holding and use of data applicable to a database in Israel, with the necessary modifications. Reg. 3 adds a cumulative requirement often missed: the database owner must obtain the recipient's WRITTEN GUARANTEE that it is taking adequate measures to protect privacy and that it will not pass the data on to anyone else — so an onward-transfer prohibition is mandatory, not optional. Israel holds an EU adequacy decision, which Amendment 13 was partly designed to preserve. Marked 'check': the primary texts are Hebrew-language, the PPA has issued further guidance on these regulations, and the interaction with Amendment 13's expanded enforcement powers is still bedding in.

The duty comes from the 2017 Data Security Regulations rather than from the Law itself: the owner of a database at the high or medium security level must immediately notify the Privacy Protection Authority of a 'severe security incident' and follow up with a report on the steps taken. What counts as severe depends on the database's assigned security level — for a high-level database, any unauthorised use of data or harm to its integrity; for a medium-level database, the same but only as to a material part. Israel differs structurally from the GDPR on who tells the individual: the PPA may ORDER the database owner to notify affected data subjects, after consulting the head of the National Cyber Directorate, rather than the owner making that call itself. Amendment 13, in force August 14, 2025, substantially expanded the PPA's investigative and administrative-fine powers, raising the stakes on this duty. Marked 'check': the security-level classification that determines the trigger is fact-specific, and the primary texts are Hebrew-language.