Israel EU Adequacy: Paperless Transfers and Their Conditions

Transfers of personal data from EU/EEA controllers and processors to recipients in Israel on the same footing as intra-EU flows, no standard contractual clauses, no transfer impact assessments, no derogations, for automated processing (the decision's scope covers automated transfers and automated processing of transferred data). All other GDPR duties still apply to the EU exporter: lawful basis, notice, processor contracts under Article 28 where the Israeli recipient is a processor. Adequacy solves Chapter V only; it is a transfer mechanism, not a compliance waiver.

The Commission's report on the eleven pre-GDPR adequacy decisions (published January 15, 2024) found that Israel continues to provide an adequate level of protection, pointing to developments including the Data Security Regulations 2017, the 2023 regulations on EEA-origin data, PPA enforcement activity, and the then-pending Amendment 13. The review also standardized ongoing monitoring: adequacy is now periodically reassessed, and material regressions, weakened oversight, or surveillance-law changes could reopen it. For planning purposes: adequacy is stable but conditional, and Israeli reforms have been calibrated to keep it.

Israeli regulations from 2023 that attach extra duties to personal data an Israeli entity received from the EEA under the adequacy decision: obligations to delete data on request and when no longer needed, ensure accuracy, limit retention, pass rectifications along, and notify data subjects in defined cases, essentially importing GDPR expectations the older Israeli law lacked, but only for EEA-lineage data. Israeli companies therefore run dual-track obligations: baseline Israeli law for domestic data, enhanced duties for EEA-sourced records. Systems need lineage tagging to apply the right track, which is the operational cost of paperless transfers.

Not automatically. The decision requires that onward transfers from Israel not undermine the protection guaranteed; the EEA-origin regulations and Israeli transfer rules (Privacy Protection (Transfer of Data Abroad) Regulations, 5761-2001) govern the Israeli exporter's side, permitting transfers to countries with adequate protection (including EU members and countries the EU recognizes), or on conditions like consent and contractual safeguards. So an Israeli SaaS company receiving EU customer data and sub-processing it in the US needs its own lawful onward mechanism, and its EU customers will diligence exactly that chain in vendor reviews.

Four disciplines: (1) tag EEA-origin data and enforce the 2023 regulations' deletion, accuracy, and retention duties on it; (2) comply with Amendment 13's governance (DPO where triggered, breach notification, fine-backed duties) since PPA enforcement credibility is part of the EU's assessment; (3) maintain the Data Security Regulations' tiered controls, they are the demonstrable security baseline; (4) paper onward transfers properly. Commercially, adequacy is a sales asset for Israeli vendors, EU customers skip transfer assessments, and it survives only as long as the aggregate system persuades the Commission's periodic reviews.