Israel Privacy Protection Law: Amendment 13 Changes Everything

Five headlines: (1) definitions modernized, 'personal data' and 'sensitive data' ('data of special sensitivity') now read like GDPR terms, covering biometric, genetic, location, and behavioral data explicitly; (2) enforcement transformed, the PPA can levy administrative fines scaled by violation and database size instead of relying on the old criminal-first toolkit; (3) database registration largely abolished, retained only for data brokers and certain public-body databases, with notification duties replacing it; (4) mandatory privacy protection officers for defined categories; (5) expanded judicial remedies including statutory damages without proof of harm for listed violations. It applies from August 14, 2025, with organizations expected compliant on day one.

Under Amendment 13: public bodies; database brokers (entities whose main purpose is collecting personal data to provide it to others); and controllers or processors whose core activities involve processing data of special sensitivity at scale, or regular and systematic monitoring of individuals at scale, banks, insurers, HMOs, telecoms, and large digital platforms are the paradigm cases. The officer must have suitable qualifications, report to management, avoid conflicts of interest, and serve as the PPA contact point. It is deliberately parallel to GDPR Article 37, letting multinationals extend their EU DPO structure to Israel with a local mandate.

The old law required registering most databases with the Registrar, a bureaucratic regime honored substantially in the breach (hundreds of thousands of unregistered databases by the PPA's own estimates). Amendment 13 scrapped it for ordinary companies: registration now applies mainly to data brokers and to public bodies holding large sensitive databases, while databases above defined size/sensitivity thresholds owe the PPA a notification with prescribed particulars. The practical shift: effort moves from filing forms to maintaining governance, database definitions documents, security protocols under the 2017 Regulations, DPO appointments, and breach readiness.

The 2017 Regulations remain Israel's binding, prescriptive security floor, unusual globally for their specificity. Databases are tiered (basic, medium, high security) by sensitivity, number of subjects, and access population; duties scale accordingly: a written database definitions document, security procedures, access management, audit logging, physical safeguards, encryption expectations for transfers and portable media, penetration testing and risk surveys on fixed cycles for higher tiers, incident documentation, and mandatory notification of serious incidents to the PPA. They are enforceable independently of Amendment 13 and are the first thing the PPA asks for after a breach.

Israel has held an EU adequacy decision since 2011 (covering automated international transfers), meaning EU/EEA data flows to Israel without SCCs. The Commission's first periodic review, concluded January 2024, reaffirmed Israel's adequacy alongside ten other pre-GDPR decisions, explicitly noting Israel's strengthened framework, and Amendment 13 plus the 2023 privacy regulations on data originating from the EEA (which impose GDPR-style duties on Israeli holders of EEA data: deletion rights, retention limits, notification duties) were central to that outcome. For companies, the practical consequences: EU-Israel flows stay paperless, and EEA-origin data inside Israeli systems carries its own enhanced duty set. See the Israel adequacy guide for the mechanics.