When a DPO is required
Amendment 13 to the Privacy Protection Law
In force since 14 August 2025, the amendment introduced a DPO duty in section 17B1 of the law for four categories:
- Public bodies, subject to exceptions, and processors that handle data on behalf of a public body.
- Controllers of databases whose main purpose is collecting personal data to provide it to others as a business or for consideration, including direct marketing services, with data on 10,000 or more people.
- Organizations whose core activities involve regular and systematic monitoring of individuals on a significant scale.
- Organizations whose core activities involve processing specially sensitive data on a significant scale.
On 14 July 2026, the Privacy Protection Authority published final guidance on the duty, the officer's expertise and position. The Authority stated it will apply this interpretation when exercising its enforcement powers, including monetary sanctions.
Article 37 GDPR
GDPR requires a DPO in substantively similar cases: public authorities, and organizations whose core activities involve large-scale systematic monitoring or large-scale processing of special categories of data. An Israeli company subject to GDPR must assess the duty under both regimes.
CCPA and state laws
The CCPA and other US state privacy laws do not require a DPO. Many US companies appoint a privacy lead as a governance choice.
The assessment depends on actual activities, not industry labels. Sometimes the answer is that no duty applies, and appointing a DPO becomes a management decision.
What a DPO actually does
- Advises management and staff on any decision involving personal data: a new system, a new vendor, a new use of existing data.
- Sets an annual work plan with priorities, owners and review dates.
- Trains and monitors: role-based training and checks that procedures are followed.
- Handles requests from individuals and from the regulator.
- Takes part in security incidents: assessment, documentation and the decision whether to notify.
- Reports to management: periodic status, open gaps and decisions needed.
How the service works
Duty and fit assessment. A first conversation on your organization, processing activities and data types. A written conclusion: whether a duty applies, and what scope makes sense.
Baseline. Mapping databases, systems, vendors and data flows against legal requirements.
Work plan. Gaps prioritized by risk, with timelines and owners.
Ongoing support. Availability for questions, project involvement, training, monitoring and reporting.
Possible deliverables
- Gap assessment
- Records of processing (ROPA)
- Data protection impact assessments (DPIA)
- Policies and procedures
- Data subject request process
- Vendor reviews and data processing agreements (DPA)
- Incident response procedure
- Training plan
- Management reports
Independence and conflicts of interest
The Authority's guidance stresses that a DPO must act independently, without roles that create a conflict of interest, and with direct access to management. An outsourced DPO, outside the organization's regular reporting line, can make this requirement easier to meet, provided the scope of the role and its access to management are set out in the engagement.
Scope and availability are set in the engagement agreement.
When this service is not the right fit
When an organization is looking for a name on paper, without involvement in decisions or a budget for implementation. Such an appointment does not reduce risk and can make it harder to show the regulator that the duty is met in practice.
For the broader framework, see Israeli Privacy Law and Regulation and Standards.