الصفحة الرئيسية › مكتبة القوانين › Israel PPL / Amendment 13
IL
Israel PPL / Amendment 13
Protection of Privacy Law, 5741-1981 (as amended by Amendment No. 13)
موثّق المصدر · 13/14 معلومات مؤكَّدة من مصدرين. آخر تحقق 11 أكتوبر 2026
موعد المراجعة الكاملة التالية: . نتابع أخبار الجهات الرقابية شهريًا، وتُسجَّل التغييرات في سجل التغييرات.
الاستشهاد بهذه الصفحة: GlanceDesk Jurisdiction, “Israel PPL / Amendment 13 (Israel)”, glancedeskjurisdiction.com/laws/il-ppl, last verified 11 October 2026.
Israel الخصوصية
- الحالة
- In force; Amendment 13 (approved by the Knesset 5 Aug 2024) took effect 14 August 2025.✓
- على من ينطبق
- Controllers and processors of personal data in Israel. Amendment 13 broadened 'personal information' and 'processing' toward GDPR. Separate 2023 rules apply to data transferred from the EEA.✓
- حدود الحجم
- Registration mainly for databases over 10,000 people whose main purpose is selling/transferring data, and public bodies. Sensitive-data databases over 100,000 people must notify the PPA.✓
- الجهة الرقابية
- Privacy Protection Authority (PPA), Ministry of Justice✓
- الإبلاغ عن الخروقات أو الحوادث
- Under Data Security Regulations 2017, reg. 11(d), a controller must immediately notify the Privacy Protection Authority (the Registrar) of a 'severe security incident' and report what it did in response. The PPA may order notice to data subjects who could be harmed (reg. 11(d)(2)), after consulting the National Cyber Directorate. Since its September 2022 policy, the PPA expects a report as soon as a severe incident is reasonably suspected, not only once it is confirmed. 'Severe' is defined in reg. 1 by security level: for high-security databases, any unauthorised use or integrity breach; for medium-security databases, unauthorised use of a substantial part of the database.✓
- مهلة الرد على طلبات البيانات الشخصية
- The database owner must allow inspection (access) within 30 days of receiving the request (Privacy Protection Regulations (Conditions for Inspection and Appeal Procedures) 1981, reg. 2; PPL s.13). A refusal must be notified (the regulations set 21 days, and silence counts as refusal). The individual can appeal to the Magistrates' Court within 30 days of the refusal. Correction or deletion requests go under PPL s.14.✓
- مسؤول حماية البيانات
- Required for public bodies, data brokers holding data on more than 10,000 people, large-scale systematic monitoring, and large-scale sensitive data processing. Reports to senior management; may be external.✓
- الممثل المحلي
- No requirement found for a foreign business to appoint a local representative in Israel under the Protection of Privacy Law as amended by Amendment 13. Database registration applications must give the controller's address in Israel (s.9(b)(1)), but this applies only to databases that must register. The PPA's 13 Apr 2026 opinion on reg. 2(4) says, in a footnote, that some databases abroad may be subject to all provisions of Israeli law even if not registered in Israel; it does not say when. Separately, a Ministry of Justice draft bill (published 27 Jan 2026, not enacted) would require foreign businesses targeting Israeli customers to publish on their website the address of an Israeli representative or an email address for service of court papers.
- نقل البيانات إلى الخارج
- Privacy Protection (Transfer of Data to Databases Abroad) Regulations 5761-2001: reg. 1 allows a transfer only if the destination's law gives protection no lower than Israeli law. Reg. 2 lists alternatives, including consent of the data subject, transfer to a company under the exporter's control that guarantees privacy, a recipient bound by agreement to follow the conditions that apply to an Israeli database (reg. 2(4)), and destination countries that are party to Convention 108 or receive data from EU states on the same terms. Reg. 3 requires a written undertaking from the recipient that it takes adequate measures to protect privacy and will not pass the data to anyone else. The PPA's opinion of 13 Apr 2026 sets what a reg. 2(4) agreement must contain: purpose limitation, access, correction and deletion rights, confidentiality, and security (either the Data Security Regulations 2017 or ISO/IEC 27001 plus Directive 3/2018), plus the EEA-regulation duties where EEA data is involved. The PPA's opinion on reg. 3 (13 Oct 2024) allows onward transfer with the Israeli exporter's written consent. Data received from the EEA carries extra duties under the Privacy Protection Regulations (Instructions for Data Transferred to Israel from the EEA) 5783-2023: deletion on request, data accuracy, notice to the individual within one month of receipt, and ethnic origin and trade-union membership treated as sensitive data. These apply to such data, and from 1 Jan 2025 to other data in the same databases. On 15 Jan 2024 the European Commission's review kept Israel's EU adequacy decision in place.✓
- ملفات تعريف الارتباط والموافقة
- Israel has no cookie-specific statute. Consent under the PPL ('informed consent, explicit or implied', s.3) governs. The PPA's opinion on consent under privacy law, dated 25 Feb 2026 and not marked as a draft, requires that consent be a real, informed choice. Notices must name the data types and purposes, and open-ended lists ('including', 'etc.') generally do not suffice. Active opt-in is expected for processing not needed for the core service, such as profiling, for direct marketing not tied to the transaction, and for sensitive data used against customer expectations. Where there is a strong power imbalance, such as an employer or an essential service, consent may be treated as suspect and the controller must show it was freely given. Implied consent from continuing to use a website after notice is generally accepted, but only where the collection reasonably fits the service. Silence alone is not consent, and implied consent for one purpose does not cover another.✓
- أقصى عقوبة
- PPA administrative fines scale with violation type, number of data subjects (e.g., NIS 100 per person) and company size, and can reach millions of NIS. Statutory damages NIS 10,000 without proof of harm; up to 3–5 years' prison for offences.✓
المعلومات الموسومة بعبارة «قيد التحقق» لا تزال قيد التأكيد ولا تُقدَّم كإجابات.
ما يجب عليك فعله✓
- Check whether Amendment 13 requires you to appoint a DPO, and appoint one if so.
- Re-check database registration: now mainly for data brokers and public bodies.
- Notify the PPA if you hold sensitive data on more than 100,000 people.
التغييرات الأخيرة
Amendment 13 in force 14 Aug 2025: GDPR-style definitions, DPO duty (enforcement grace period to 31 Oct 2025), narrower registration, major administrative fines and new PPA powers. The PPA has signalled cross-sector inspections and stricter enforcement.✓
المصادر
- المصدر الأساسي: https://www.gov.il/en/departments/the_privacy_protection_authority/govil-landing-page
- المصدر الثاني: https://resourcehub.bakermckenzie.com/en/resources/global-data-and-cyber-handbook/emea/israel/topics/regulators-enforcement-priorities-and-penalties
- الجهة الرقابية: Privacy Protection Authority (PPA), Ministry of Justice
المصادر المستخدمة في التحقق المستقل (30)
- https://www.loc.gov/item/global-legal-monitor/2025-11-17/israel-amendment-to-privacy-protection-law-goes-into-effect/
- https://www.gornitzky.com/an-amendment-to-the-israeli-protection-of-privacy-law-will-increase-exposure-for-violation-of-data-protection-requirements/
- https://www.dlapiperdataprotection.com/index.html?t=law&c=IL
- https://www.gov.il/en/departments/the_privacy_protection_authority/govil-landing-page
- https://resourcehub.bakermckenzie.com/en/resources/global-data-and-cyber-handbook/emea/israel/topics/regulators-enforcement-priorities-and-penalties
- https://www.pearlcohen.com/israel-significant-amendment-to-the-privacy-law-takes-effect/
- https://www.gov.il/BlobFolder/legalinfo/data_security_regulation/en/5777%E2%80%932017.pdf
- https://www.law.co.il/en/news/2022/09/14/policy-on-breach-notification-timescales/
- https://www.pearlcohen.com/israel-privacy-protection-authority-hardens-its-policy-on-breach-notification-timescales/
- https://www.gov.il/BlobFolder/legalinfo/right_of_access/ar/av_recordings.pdf
- https://www.kolzchut.org.il/he/%D7%A2%D7%99%D7%95%D7%9F_%D7%91%D7%9E%D7%99%D7%93%D7%A2_%D7%90%D7%99%D7%A9%D7%99_%D7%94%D7%9E%D7%95%D7%97%D7%96%D7%A7_%D7%91%D7%9E%D7%90%D7%92%D7%A8%D7%99_%D7%9E%D7%99%D7%93%D7%A2
- https://clym.io/regulations/israel-ppl
- https://www.gornitzky.com/cross-border-data-transfer-agreements-the-position-of-the-israeli-privacy-protection-authority-2/
- https://www.pearlcohen.com/israeli-privacy-authority-issues-guidelines-on-data-transfers-and-tracking-tags/
- https://www.insideprivacy.com/cross-border-transfers/european-commission-retains-adequacy-decisions-for-data-transfers-to-eleven-countries/
- https://www.shibolet.com/%D7%92%D7%99%D7%9C%D7%95%D7%99-%D7%93%D7%A2%D7%AA-%D7%A1%D7%95%D7%A4%D7%99-%D7%91%D7%A0%D7%95%D7%A9%D7%90-%D7%94%D7%A1%D7%9B%D7%9E%D7%94-%D7%9E%D7%98%D7%A2%D7%9D-%D7%94%D7%A8%D7%A9%D7%95%D7%AA/
- https://www.pearlcohen.com/israeli-privacy-regulator-issues-position-paper-on-valid-consent/
- https://www.gov.il/BlobFolder/legalinfo/legislation/en/Protection-of-Privacy-Law57411981unofficialtranslatioup.pdf
- https://www.gov.il/BlobFolder/legalinfo/infoabroad/he/infoabroad.pdf
- https://herzoglaw.co.il/en/news-and-insights/draft-bill-on-the-application-of-laws-to-a-foreign-dealer-directing-its-activity-toward-customers-in-israel-5786-2026/
- https://www.pearlcohen.com/israel-proposes-law-to-apply-privacy-and-consumer-protections-extraterritorially/
- https://practiceguides.chambers.com/practice-guides/data-protection-privacy-2026/israel
- https://www.gov.il/BlobFolder/legalinfo/legislation/en/Privacy-ProtectionTransferofDataabroadRegulationsun.pdf
- https://www.gov.il/BlobFolder/legalinfo/takana3/en/en-regulation3.pdf
- https://www.gov.il/BlobFolder/legalinfo/datatransferredisrael2023/en/Privacy%20Protection%20Regulations%20(Instructions%20for%20Data%20that%20was%20transferred%20to%20Israel%20from%20the%20European%20Economic%20Area).pdf
- https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en
- https://www.pearlcohen.com/israeli-privacy-regulator-clarifies-requirements-for-cross-border-data-transfers/
- https://www.hunton.com/privacy-and-cybersecurity-law-blog/european-commission-reviews-and-reaffirms-adequacy-decisions-for-11-jurisdictions
- https://www.gov.il/BlobFolder/legalinfo/consent-2026/he/cpncent-2025.pdf
- https://www.gornitzky.com/israeli-privacy-protection-authority-publishes-new-guidance-on-obtaining-consent/
= مؤكَّد من مصدرين مستقلين، أحدهما على الأقل رسمي. كيف نتحقق
معلومات فقط، وليست استشارة قانونية. القوانين تتغير؛ تحقّق مع الجهة الرقابية أو محامٍ مؤهل قبل الاعتماد على هذه الصفحة. هل لاحظت خطأ؟ راسلنا على contact@