Privacy Protection (Transfer of Data to Databases Abroad) Regulations, 5761-2001

The duty comes from a dedicated 2001 regulation rather than from the Law. Reg. 2's baseline is that data may be transferred out of Israel only where the destination country's law ensures a level of protection at least equal to Israeli law — with a set of alternative grounds, the most used being reg. 2(4): the recipient is bound by agreement with the Israeli database owner to comply with the conditions governing the holding and use of data applicable to a database in Israel, with the necessary modifications. Reg. 3 adds a cumulative requirement often missed: the database owner must obtain the recipient's WRITTEN GUARANTEE that it is taking adequate measures to protect privacy and that it will not pass the data on to anyone else — so an onward-transfer prohibition is mandatory, not optional. Israel holds an EU adequacy decision, which Amendment 13 was partly designed to preserve. Marked 'check': the primary texts are Hebrew-language, the PPA has issued further guidance on these regulations, and the interaction with Amendment 13's expanded enforcement powers is still bedding in.