Home › Compare laws side by side › Israel PPL / Amendment 13 vs EU GDPR
Israel PPL / Amendment 13 vs EU GDPR
Protection of Privacy Law, 5741-1981 (as amended by Amendment No. 13) (Israel) compared with Regulation (EU) 2016/679 (General Data Protection Regulation) (European Union (EEA)) on the same topics. Every value comes from the law pages, which link to the official sources.
| Topic | Israel PPL / Amendment 13 Israel 13/14 facts confirmed by two sources | EU GDPR European Union (EEA) ✓ Confirmed by two sources |
|---|---|---|
| Status | In force; Amendment 13 (approved by the Knesset 5 Aug 2024) took effect 14 August 2025.✓ | In force since 25 May 2018. Digital Omnibus amendments proposed Nov 2025, not adopted as of Oct 2026.✓ |
| Who it applies to | Controllers and processors of personal data in Israel. Amendment 13 broadened 'personal information' and 'processing' toward GDPR. Separate 2023 rules apply to data transferred from the EEA.✓ | Any organisation processing personal data in the context of an EU establishment, plus non-EU organisations that offer goods/services to people in the EU or monitor their behaviour there.✓ |
| Size thresholds | Registration mainly for databases over 10,000 people whose main purpose is selling/transferring data, and public bodies. Sensitive-data databases over 100,000 people must notify the PPA.✓ | None — applies regardless of size. Limited record-keeping relief for organisations under 250 staff (Art 30(5)), lost if processing is risky, not occasional, or includes special-category or criminal data.✓ |
| Regulator | Privacy Protection Authority (PPA), Ministry of Justice✓ | National data protection authorities (DPAs), coordinated by the European Data Protection Board (EDPB)✓ |
| Breach or incident reporting | Under Data Security Regulations 2017, reg. 11(d), a controller must immediately notify the Privacy Protection Authority (the Registrar) of a 'severe security incident' and report what it did in response. The PPA may order notice to data subjects who could be harmed (reg. 11(d)(2)), after consulting the National Cyber Directorate. Since its September 2022 policy, the PPA expects a report as soon as a severe incident is reasonably suspected, not only once it is confirmed. 'Severe' is defined in reg. 1 by security level: for high-security databases, any unauthorised use or integrity breach; for medium-security databases, unauthorised use of a substantial part of the database.✓ | Notify the competent supervisory authority without undue delay and within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to individuals (Art 33). If you have an EU main establishment, that is your lead authority; if you have no EU establishment (even with an EU representative), notify the authority of every member state where affected people live (EDPB Guidelines 9/2022, para 73). Tell affected individuals without undue delay if the risk is high (Art 34).✓ |
| Deadline to answer personal data requests | The database owner must allow inspection (access) within 30 days of receiving the request (Privacy Protection Regulations (Conditions for Inspection and Appeal Procedures) 1981, reg. 2; PPL s.13). A refusal must be notified (the regulations set 21 days, and silence counts as refusal). The individual can appeal to the Magistrates' Court within 30 days of the refusal. Correction or deletion requests go under PPL s.14.✓ | 1 month from receipt; extendable by 2 further months for complex requests if the person is told within the first month. Free of charge unless manifestly unfounded or excessive.✓ |
| Data protection officer | Required for public bodies, data brokers holding data on more than 10,000 people, large-scale systematic monitoring, and large-scale sensitive data processing. Reports to senior management; may be external.✓ | DPO mandatory for public bodies, and where core activities involve large-scale regular and systematic monitoring, or large-scale processing of special-category or criminal-offence data.✓ |
| Local representative | No requirement found for a foreign business to appoint a local representative in Israel under the Protection of Privacy Law as amended by Amendment 13. Database registration applications must give the controller's address in Israel (s.9(b)(1)), but this applies only to databases that must register. The PPA's 13 Apr 2026 opinion on reg. 2(4) says, in a footnote, that some databases abroad may be subject to all provisions of Israeli law even if not registered in Israel; it does not say when. Separately, a Ministry of Justice draft bill (published 27 Jan 2026, not enacted) would require foreign businesses targeting Israeli customers to publish on their website the address of an Israeli representative or an email address for service of court papers. | Non-EU controllers/processors caught by Art 3(2) must appoint an EU representative in writing, unless processing is occasional, low-risk and excludes large-scale sensitive data, or they are a public body.✓ |
| Sending data abroad | Privacy Protection (Transfer of Data to Databases Abroad) Regulations 5761-2001: reg. 1 allows a transfer only if the destination's law gives protection no lower than Israeli law. Reg. 2 lists alternatives, including consent of the data subject, transfer to a company under the exporter's control that guarantees privacy, a recipient bound by agreement to follow the conditions that apply to an Israeli database (reg. 2(4)), and destination countries that are party to Convention 108 or receive data from EU states on the same terms. Reg. 3 requires a written undertaking from the recipient that it takes adequate measures to protect privacy and will not pass the data to anyone else. The PPA's opinion of 13 Apr 2026 sets what a reg. 2(4) agreement must contain: purpose limitation, access, correction and deletion rights, confidentiality, and security (either the Data Security Regulations 2017 or ISO/IEC 27001 plus Directive 3/2018), plus the EEA-regulation duties where EEA data is involved. The PPA's opinion on reg. 3 (13 Oct 2024) allows onward transfer with the Israeli exporter's written consent. Data received from the EEA carries extra duties under the Privacy Protection Regulations (Instructions for Data Transferred to Israel from the EEA) 5783-2023: deletion on request, data accuracy, notice to the individual within one month of receipt, and ethnic origin and trade-union membership treated as sensitive data. These apply to such data, and from 1 Jan 2025 to other data in the same databases. On 15 Jan 2024 the European Commission's review kept Israel's EU adequacy decision in place.✓ | Transfers outside the EEA need an adequacy decision (e.g. UK, Switzerland, EU-US Data Privacy Framework), or safeguards such as Standard Contractual Clauses or Binding Corporate Rules, or a narrow Art 49 derogation.✓ |
| Cookies and consent | Israel has no cookie-specific statute. Consent under the PPL ('informed consent, explicit or implied', s.3) governs. The PPA's opinion on consent under privacy law, dated 25 Feb 2026 and not marked as a draft, requires that consent be a real, informed choice. Notices must name the data types and purposes, and open-ended lists ('including', 'etc.') generally do not suffice. Active opt-in is expected for processing not needed for the core service, such as profiling, for direct marketing not tied to the transaction, and for sensitive data used against customer expectations. Where there is a strong power imbalance, such as an employer or an essential service, consent may be treated as suspect and the controller must show it was freely given. Implied consent from continuing to use a website after notice is generally accepted, but only where the collection reasonably fits the service. Silence alone is not consent, and implied consent for one purpose does not cover another.✓ | Cookie/tracker consent is governed by the ePrivacy Directive Art 5(3); where consent is the GDPR legal basis it must be freely given, specific, informed, unambiguous and as easy to withdraw as to give.✓ |
| Maximum penalty | PPA administrative fines scale with violation type, number of data subjects (e.g., NIS 100 per person) and company size, and can reach millions of NIS. Statutory damages NIS 10,000 without proof of harm; up to 3–5 years' prison for offences.✓ | Up to EUR 20 million or 4% of total worldwide annual turnover, whichever is higher (lower tier: EUR 10 million or 2%).✓ |
= confirmed by two independent sources, at least one official.
Facts marked “Being verified” are still being confirmed and are not given as answers.
Who each law applies to
- Israel PPL / Amendment 13
- Controllers and processors of personal data in Israel. Amendment 13 broadened 'personal information' and 'processing' toward GDPR. Separate 2023 rules apply to data transferred from the EEA.
- EU GDPR
- Any organisation processing personal data in the context of an EU establishment, plus non-EU organisations that offer goods/services to people in the EU or monitor their behaviour there.
What you must do under Israel PPL / Amendment 13
- Check whether Amendment 13 requires you to appoint a DPO, and appoint one if so.
- Re-check database registration: now mainly for data brokers and public bodies.
- Notify the PPA if you hold sensitive data on more than 100,000 people.
What you must do under EU GDPR
- Identify a lawful basis for every processing purpose and record it.
- Publish a clear privacy notice covering purposes, recipients, retention and rights.
- Keep a record of processing activities and sign Art 28 contracts with processors.
- Run a DPIA before high-risk processing such as large-scale profiling or sensitive data.
- Report qualifying breaches within 72 hours (lead authority, or every relevant DPA if you have no EU establishment) and log all breaches.
- Answer access, erasure and other rights requests within one month.
Information only, not legal advice. Laws change; confirm with the regulator or a qualified lawyer before relying on this page. Spotted an error? Email contact@