European Union: GDPR
When it applies to an Israeli company. Under Article 3(2), GDPR applies to organizations outside the EU that offer goods or services to people in the EU, or monitor their behavior there.
What is usually required. A lawful basis for each processing activity, transparent notices, handling of data subject rights, data processing agreements with vendors, and in some cases an EU representative (Article 27) and a DPO (Article 37).
Transfers. The EU recognizes Israel as providing an adequate level of protection, which eases transfers from the EU to Israel. Adequacy does not remove other GDPR obligations and does not cover onward transfers to third countries.
United Kingdom: UK GDPR
Since Brexit, the UK has its own framework, substantively similar to GDPR. A company active in both markets needs to consider both.
United States: CCPA and state laws
There is no general federal privacy law in the US. The California Consumer Privacy Act (CCPA), as amended by the CPRA, and a growing number of other state laws apply to businesses that meet revenue, data volume or data sale thresholds. Requirements include disclosures, consumer rights, restrictions on selling and sharing data, and vendor contracts.
How the work is done
Applicability mapping. Which regimes apply, to which activities and to which individuals.
Shared framework. Procedures and documents that meet the common requirements, with regime-specific adjustments.
Contracts. Data processing agreements, transfer clauses and alignment with foreign customers' requirements.
Customer questionnaires. Support in answering enterprise customers' security and privacy questionnaires.
Compliance program
Risk register. Identifying legal and operational risks, assessing severity and likelihood, and assigning ownership.
Requirements map. Consolidating requirements from law, regulations, contracts and chosen standards in one place.
Controls. Defining controls, owners and testing frequency.
Evidence. Documentation that demonstrates compliance to a regulator, customer or auditor.
Management and the board
Boards and management are increasingly expected to oversee data, cyber and AI risk, and to document that oversight. The firm helps design periodic reporting, define responsibilities and brief directors.
International standards
Standards are not legal obligations, but they are a shared language with customers, auditors and investors, and sometimes a route to meeting a legal duty. For example, under the Israeli Privacy Protection Authority's April 2026 guidance on cross-border transfers, a recipient may, as an alternative, declare and undertake that its organization is certified to ISO/IEC 27001 and complies with it, together with an undertaking to comply with specified provisions of the Data Security Regulations.
The work is tailored to the frameworks, requirements and standards relevant to the organization and the process under review, according to need and the scope of the engagement.
Scope of work
This practice covers data, privacy, cybersecurity and AI risk. The firm does not advise on general corporate law, mergers and acquisitions or corporate governance in its broader sense.
This support is provided from the perspective of an Israeli attorney practicing privacy law. Where an opinion under foreign law or representation before a foreign authority is needed, the work is done together with local counsel in that jurisdiction.