Home › Law library › Israel PPL / Amendment 13
IL
Israel PPL / Amendment 13
Protection of Privacy Law, 5741-1981 (as amended by Amendment No. 13)
Sourced. Last verified 9 October 2026
Israel Privacy
- Status
- In force; Amendment 13 (approved by the Knesset 5 Aug 2024) took effect 14 August 2025.
- Who it applies to
- Controllers and processors of personal data in Israel. Amendment 13 broadened 'personal information' and 'processing' toward GDPR. Separate 2023 rules apply to data transferred from the EEA.
- Size thresholds
- Registration mainly for databases over 10,000 people whose main purpose is selling/transferring data, and public bodies. Sensitive-data databases over 100,000 people must notify the PPA.
- Regulator
- Privacy Protection Authority (PPA), Ministry of Justice
- Breach or incident reporting
- Under the 2017 Data Security Regulations, report severe security incidents to the PPA immediately (even a suspected serious incident); the PPA may order notice to individuals.
- Deadline to answer personal data requests
- Being verified
- Data protection officer
- Required for public bodies, data brokers holding data on more than 10,000 people, large-scale systematic monitoring, and large-scale sensitive data processing. Reports to senior management; may be external.
- Local representative
- Being verified
- Sending data abroad
- Governed by the 2001 Transfer Regulations. Israel has EU adequacy (reconfirmed 15 Jan 2024). EEA-origin data has extra deletion and accuracy duties under 2023 regulations.
- Cookies and consent
- No cookie-specific rules; general informed-consent, purpose and proportionality rules apply. Get fresh consent for any new purpose.
- Maximum penalty
- PPA administrative fines scale with violation type, number of data subjects (e.g., NIS 100 per person) and company size, and can reach millions of NIS. Statutory damages NIS 10,000 without proof of harm; up to 3–5 years' prison for offences.
Facts marked “Being verified” are still being confirmed and are not given as answers.
What you must do
- Check whether Amendment 13 requires you to appoint a DPO, and appoint one if so.
- Re-check database registration: now mainly for data brokers and public bodies.
- Notify the PPA if you hold sensitive data on more than 100,000 people.
- Apply the Data Security Regulations and report severe incidents to the PPA immediately.
- Apply the 2023 EEA-data rules to personal data received from Europe.
- Get fresh informed consent before using data for a new purpose.
Recent changes
Amendment 13 in force 14 Aug 2025: GDPR-style definitions, DPO duty, narrower registration, major administrative fines and new PPA powers. PPA announced cross-sector audits and 2026 enforcement priorities.
Sources
- Primary source: https://www.gov.il/en/departments/the_privacy_protection_authority/govil-landing-page
- Second source: https://resourcehub.bakermckenzie.com/en/resources/global-data-and-cyber-handbook/emea/israel/topics/regulators-enforcement-priorities-and-penalties
- Regulator: Privacy Protection Authority (PPA), Ministry of Justice
Information only, not legal advice. Laws change; confirm with the regulator or a qualified lawyer before relying on this page. Spotted an error? Email [email protected].