Data safety

Which Israeli laws cover customer data?

Israel’s Protection of Privacy Law, 5741-1981, is the main law on information about people held in databases. The Privacy Protection (Data Security) Regulations, 5777-2017, set the security duties. Amendment 13 to the law changed its definitions, its notice duty and its enforcement.

Source: the law and the regulations, unofficial English translations by the Privacy Protection Authority, read on 28 October 2026.

What counts as personal data?

Personal data is any data item relating to an identified or identifiable person. A person is identifiable if they can be identified with reasonable effort, directly or indirectly, including by a name, an identification number, biometric data, location data or an online identifier.

Source: Protection of Privacy Law, definitions, unofficial English translation updated after Amendment 13, read on 28 October 2026.

What must a business tell people when it asks for their details?

A request to receive personal data for a database must come with a notice. The notice says whether giving the data is required by law or is voluntary and what follows if the person does not agree; the purpose; the name and contact details of the database controller; to whom the data will be delivered and why; and that the person has a right to see their data and to ask for it to be corrected.

Source: Protection of Privacy Law, section 11, unofficial English translation updated after Amendment 13, read on 28 October 2026.

Who is responsible for keeping the data secure?

The database controller and the processor are each responsible for the security of the data in the database. A processor is an outside party that processes data on the controller’s behalf.

Source: Protection of Privacy Law, section 17(a) and the definition of processor, unofficial English translation updated after Amendment 13, read on 28 October 2026.

Do all databases need the same level of security?

No. The regulations define four groups: a database managed by an individual, and databases at a basic, a medium or a high security level. A database managed by an individual is one managed by a single person, or a company they own, in which only that person and at most two other authorised users can use it. That group does not apply if the database is mainly for passing data to others as a regular professional activity, holds data on 10,000 or more people, or is subject to a professional confidentiality duty. The basic level is any database not in the other groups.

Source: Data Security Regulations 5777-2017, regulation 1 (definitions), unofficial English translation, read on 28 October 2026. What puts a database in the medium or high group depends on the schedules to the regulations; this page does not describe them.

What must be done after a serious security incident?

For databases at a medium or high security level, a severe security incident must be reported to the Registrar immediately, with the steps taken. The regulation says immediately and gives no number of hours. The Registrar may also order the controller to tell the affected people, after consulting the head of the National Cyber Defense Authority. Whether an incident is severe in a given business, and when the duty starts, is a legal question that this page does not answer.

Source: Data Security Regulations 5777-2017, regulation 11(d) and the definition of a severe security incident in regulation 1, unofficial English translation, read on 28 October 2026.

When must a database be registered?

A database must be registered if its main purpose is to collect personal data in order to provide it to others as a business practice or for consideration, including direct mail services, and it holds data on more than 10,000 people; or if the controller is a public body, unless the data is only about its own employees. This is one rule, not the whole section.

Source: Protection of Privacy Law, section 8A(a)(1), unofficial English translation updated after Amendment 13, read on 28 October 2026.

What about sending data abroad, fines and a privacy officer?

Transfers of data abroad have their own regulations. Amendment 13 gave the Authority power to impose administrative fines and requires some bodies to appoint a privacy officer. We have not summarised these rules on this page because we have not read their text. Check the Authority’s pages.