What changed
Amendment 13 to the Privacy Protection Law, 1981 took effect on 14 August 2025. Among other things, it updated core definitions, changed the database registration regime, introduced a DPO duty for certain organizations, and expanded the Authority's supervisory and enforcement powers, including monetary sanctions.
Since then, the Authority has published a series of final guidance documents setting out how it interprets the law, including on consent (February 2026), cross-border transfers (April 2026) and DPO appointment (July 2026). The guidance is not legislation, but it reflects the interpretation the Authority will apply in supervision and enforcement.
Alongside the law, the Privacy Protection (Data Security) Regulations, 2017 set security requirements according to each database's risk level.
For international companies
Israel has held EU adequacy status for many years, and its data protection framework is closer to the European model than to the US one. Foreign companies with Israeli subsidiaries, Israeli customers or Israeli employees often find that their GDPR program covers much of what Israeli law requires, but not all of it. Israel's data security regulations, the database definition document and Israeli-specific notice and consent rules usually need separate attention.
How the work is done
Mapping. Which databases and systems exist, what data is collected and why, who accesses it and which vendors receive it.
Prioritization. Separating gaps that create real exposure from tasks that can wait.
Implementation. Procedures, agreements, access rights, notice and consent wording, and workflows.
Evidence and review. Documentation that shows compliance, and a periodic review cycle.
Possible deliverables
- Records of processing (ROPA) and database definition documents
- Data protection impact assessments (DPIA)
- Privacy notices, and notice and consent wording
- Vendor reviews and data processing agreements (DPA)
- Access and correction request procedure
- Data security documentation under the 2017 Regulations
- Incident response procedure
- Training for staff and management
When data leaves Israel
Transfers of personal data to a vendor or affiliate abroad are governed by the Privacy Protection (Transfer of Data to Databases Abroad) Regulations, 2001. The Authority's April 2026 guidance explains when a contractual undertaking by the recipient can be relied on, and what it must include.
See also Regulation and Standards.