Meet Israel's PPL and Amendment 13 duties with less effort

The Israel Privacy Protection Law is the Protection of Privacy Law, 5741-1981, Israel's main privacy statute. It makes infringing a person's privacy a civil wrong and, in certain cases, an offence, and it regulates databases of personal information: registration, notice to individuals, rights of access and correction, confidentiality and information security. It is enforced by the Privacy Protection Authority within the Ministry of Justice.

Amendment 13 took effect on 14 August 2025 and is the most significant update to the law in decades. It aligned key definitions such as personal information, controller and processor more closely with modern data protection law, narrowed the database registration requirement, added a notification duty for large databases of highly sensitive information, required some organisations to appoint a privacy protection officer, and gave the Privacy Protection Authority administrative enforcement powers including monetary sanctions.

Any controller or processor of a database containing personal information in Israel must comply. That includes private companies, public bodies and service providers processing data on another organisation's behalf. Extra duties apply to some: public bodies and data brokers holding information on more than 10,000 people must register databases, and banks, insurers, public bodies and organisations carrying out large-scale sensitive processing or systematic monitoring have officer appointment duties.

Breaches can lead to administrative monetary sanctions, warnings and cessation orders from the Privacy Protection Authority, which can also ask a court to order processing to stop or data to be deleted. Some breaches are criminal offences. Individuals can sue, and for specified violations such as ignoring access requests a court may award up to NIS 10,000 per violation without proof of damage. Check current sanction amounts with Israeli counsel.

The Privacy Protection (Data Security) Regulations, 5777-2017 set out the detailed security duties that sit behind section 17 of the law. They require a database definitions document, an information security procedure, access control, logging, risk assessment or audits depending on the database's security level, and reporting of severe security incidents to the Privacy Protection Authority. The level of control required depends on the sensitivity and size of the database.

Amendment 13 moved Israeli law closer to GDPR, using similar concepts of controllers, processors, personal information and highly sensitive information, and introducing a privacy protection officer similar to a GDPR data protection officer. Differences remain, including database registration, Israel's own security levels under the 2017 regulations and its separate enforcement regime, so GDPR compliance helps but does not on its own satisfy Israeli law.

Yes, partly. An ISO 27001 information security management system already covers many of the same controls, such as access management, logging, risk assessment, supplier security and incident handling. The Israeli regulations add specific documents and duties, such as the database definitions document and incident reporting to the Authority, so organisations should map their ISO 27001 controls against the regulations and close the remaining gaps.

Yes. OneClickComply supports the Israel Privacy Protection Law today. Controls and evidence you hold for ISO 27001, GDPR or SOC 2 are mapped to Israeli requirements, with automated evidence collection, policy generation and continuous monitoring supporting your programme. OneClickComply does not certify compliance, and specific legal questions should go to Israeli counsel.