Israel

Unlike Europe's General Data Protection Regulation, Israel's Protection of Privacy Law 5741-1981 contains no express territorial-scope article. The Privacy Protection Authority's own professional guide on Amendment 13 (August 2025) states only that the law applies to anyone who collects, uses or processes personal data, public or private, excluding a private collection not held for business or public purposes. Reach over foreign entities therefore rests on interpretation rather than statutory text — the Authority's binding opinion of April 2026 on transfers abroad notes in a footnote that there may be databases located abroad that are subject to the whole of Israeli law even though their controllers are not registered in Israel. The Authority has previously opened an investigation into Facebook (2018). Duty to appoint a Data Protection Officer under Article 17B1 attaches to public bodies, data brokers holding data on more than 10,000 people, organisations whose core activity involves regular and systematic monitoring of people (search engines and mobile operators are named), and organisations processing specially sensitive data at significant scale (banks, insurers, general hospitals and health funds are named). A separate and older role, the Data Security Officer under Article 17B, applies to controllers of five registrable databases, public bodies, banks, insurers and credit-rating firms.

Sector by sector, verified on 18 August 2026. BANKING (conditional): Bank of Israel Proper Conduct of Banking Business Directive 362, current version dated 17 June 2026, section 7 — a bank may not store, transfer or process information it classifies as sensitive on a cloud outside Israel unless it has ascertained the provider's protection level complies with the European General Data Protection Regulation. Section 38 adds a duty to plan for the foreign region becoming unavailable through geopolitical events. INSURANCE AND PENSIONS (conditional plus reporting): Capital Market, Insurance and Savings Authority institutional-bodies circular 2018-9-35 on outsourcing requires a board-level outsourcing policy dealing specifically with activity performed outside Israel or with a provider located outside Israel, an assessment of the consequences of the activity being performed abroad, an annual return to the Commissioner listing every outsourcing arrangement with a yes/no field for whether it is offshore, and immediate reporting of exceptional events. HEALTH (conditional on geography, closed on organisational control): Ministry of Health Director-General circular 2/2021 on cloud computing in the health system, section 6.5, permits cloud in a country that satisfies the transfer regulations, but circulars 1/2018 and 2/2018 on secondary use of health data require that identifiable patient data used for research stays inside a secure environment within the health organisation, and any release outside the organisation's control needs Helsinki-committee approval plus a destruction undertaking. GOVERNMENT (closed in practice): the state's own cloud landing zone was deliberately migrated out of an overseas public cloud into the new Israeli region as soon as it opened, under Project Nimbus. SECURITIES, TELECOMS, EDUCATION, GAMING, GEOSPATIAL AND DEFENCE: no data-residency rule found on an Israeli government source, checked 18 August 2026, confidence medium. The National Cyber Directorate's own published map of cyber regulation records that the Ministry of Communications has not yet issued cyber rules for telecoms operators at all.

Regulation 1 of the Transfer of Data to Databases Abroad Regulations 5761-2001 sets the adequacy test. Regulation 2 lists eight alternatives: the person's consent; a vital health interest where consent cannot be obtained; transfer to a corporation under the transferor's control that has guaranteed privacy; transfer to a party contractually bound to comply with the conditions applying to a database in Israel, with necessary modifications; data already lawfully public; transfer vital to public safety or security; transfer required by Israeli law; and transfer to a country that is party to the Council of Europe convention, or that receives data from European Community member states under the same terms of acceptance, or that the Registrar has announced in the official gazette has a privacy authority with which a cooperation arrangement has been reached. Regulation 3 imposes the written guarantee on top of whichever route is used, including a promise not to onward-transfer. On 9 April 2026, updated 30 April 2026, the Privacy Protection Authority published its final binding opinion on what 'with necessary modifications' means in the contract route. The contract must bind the receiver to: purpose limitation; the right of access under Article 13; the right of correction or deletion under Article 14; and the confidentiality duty under Article 16. On security, the receiver must undertake to meet the substantive obligations of the Data Security Regulations 5777-2017, or alternatively declare it holds ISO/IEC 27001 certification including the Annex A controls and undertakes the specific regulations listed in the Authority's Guideline 3/2018. The Authority accepts that the Israeli database registration and notification duties need not be replicated abroad where the destination has no comparable duty. Critically, the opinion also confirms that where the Israeli database also holds data that arrived from the European Economic Area, the foreign receiver must additionally undertake Regulations 3 to 7 of the 2023 European Economic Area regulations.

The Authority is headed by Commissioner Gilad Semama. Amendment 13, in force since 14 August 2025, gave it inspectors, administrative inquiry powers, search and seizure powers, monetary sanctions, cease-processing orders and the ability to ask a court to order deletion of personal data. Two published post-Amendment-13 decisions as at 18 August 2026: Meuhedet Health Fund, for failing to report a severe security incident immediately as required by Regulation 11(d)(1) of the Data Security Regulations — a technical fault let some members view other people's medical records; the fund learned of it in November 2025 but only reported on 27 January 2026. Original sanction 640,000 shekels (about $180,000), reduced by 60 percent to 256,000 shekels because it had no prior violations, stopped the breach on its own initiative and had appointed a privacy officer. Second, A.D. Karting Hutzot (2014) Ltd, for a booking form that collected personal data without the notice required by Article 11 — 20,000 shekels reduced to 12,000. Rating this 'active' rather than 'aggressive': the Authority is clearly staffed, has published a graduated sanctions framework and reduction schedule, and is using it, but the published caseload is still small and the first fines are modest.

The 24-month floor comes from Regulations 10(d) and 17(a) of the Data Security Regulations 5777-2017 — records of the access-monitoring mechanism, and data collected in applying the documentation, access-control, incident and outsourcing-control regulations, all retained securely for 24 months. Regulation 17(b) requires medium and high security databases to back that up so it can always be restored. The ceiling comes from the European Economic Area regulations of 2023: Regulation 4 requires a standing organisational or technological mechanism to identify data no longer needed and delete it at the earliest opportunity, and Regulation 3 gives a written right to erasure where data was collected unlawfully or is no longer needed for its purpose. Conflicts are resolved in favour of keeping: both regulations carve out data needed to perform a legal obligation, conduct a legal proceeding or collect a debt, address fraud, protect a public interest including archival and research purposes, or meet an international agreement. Amendment 13 also pushes minimisation generally — the Authority's own preparation guidance tells businesses to reduce existing data that is no longer needed. Note that Israeli tax and company bookkeeping rules impose their own longer retention floors; we did not verify those against an official source on this run.

Regulation 11(d)(1) of the Data Security Regulations 5777-2017: on a severe security incident the controller must immediately notify the Registrar (now the head of the Privacy Protection Authority) and report the measures taken. Regulation 11(d)(2): the Registrar may, after consulting the head of the National Cyber Defence Authority, order the controller to notify a data subject who may suffer damage. 'Severe security incident' is defined narrowly: in a high-security database, any unauthorised use of data or damage to data integrity; in a medium-security database, unauthorised use of a substantial part of the database or damage to the integrity of a substantial part. Low-security databases are outside the duty. Israel's cyber regulation is deliberately decentralised — Government Resolution 2443 of 15 February 2015 chose to empower existing sector regulators rather than create a new one, so there is no cross-economy incident reporting deadline. Sector clocks that do exist include the insurance regulator's duty on institutional bodies to report an exceptional event to the Commissioner close to the time they learn of it. The Ministry of Communications had still not published cyber rules for telecoms operators as of the National Cyber Directorate's current published map.

(1) Regulation 2(a)(2) of the European Economic Area regulations extends them to 'any other data that is in a database in Israel that contains data' transferred from the European Economic Area, in force for co-mingled data from 1 January 2025. The consequences bite on export too: the Authority's April 2026 opinion requires the foreign receiver to undertake Regulations 3 to 7 as well. (2) The Meuhedet decision fined a two-month delay. (3) Article 23KF prices most breaches per data subject — 2 shekels per person, doubled to 4 for specially sensitive data, for failures such as not appointing a data security officer or data protection officer; 4 shekels per person, doubled to 8 for specially sensitive data, for processing for an unlawful purpose or ignoring a cease-processing order. On a million-person sensitive database the second band produces 8 million shekels, roughly $2.2 million. Registration breaches carry a flat 150,000 shekels (about $42,000), doubled where the database covers a million people or more; refusing an inspector documents carries 300,000 shekels (about $85,000). (4) Article 5 makes wilful infringement of privacy punishable by five years' imprisonment. Amendment 13 added a chapter of database offences: processing personal data from a database without the controller's authorisation, three years; misleading someone when asking for their personal data, three years; unlawful transfer of data out of a public body, three years. (5) Article 17B (data security officer) is triggered by holding five registrable databases, or being a public body, bank, insurer or credit rater. Article 17B1 (data protection officer) is triggered by being a public body, a data broker with more than 10,000 people, a systematic monitor, or a large-scale processor of specially sensitive data. A bonus trap: Amendment 13 abolished the short two-year limitation period for civil privacy claims, so historic exposure now runs for the ordinary limitation period.

Dated items. 14 August 2025: Amendment 13 in force, one year after publication in the official gazette on 14 August 2024. 1 January 2025: the European Economic Area regulations extended to co-mingled data. 9 April 2026, updated 30 April 2026: the final binding opinion on the contract route for transfers abroad. 16 April 2026: the Privacy Protection (Administrative Warning) Regulations 5786-2026 came into force. They let the Authority issue a warning instead of a monetary sanction in four situations — within three months of a new obligation taking effect; a first breach of certain data security regulations; up to six months after the Authority tightens its enforcement policy in an area it had not previously enforced; and up to six months where the obligation is genuinely unclear. A warning is only available where a fine could lawfully have been imposed. Dormant switches, each of which can change the picture with no consultation. First, the Authority may announce in the official gazette that a named foreign country has a privacy authority with which it has a cooperation arrangement, which turns that country into a permitted destination overnight; we could not confirm whether any such announcement has been published. Second, the Minister of Justice may by order, with the approval of the Knesset Constitution Committee, extend the per-person monetary sanction for ignoring a cease-or-rectify order to systematic monitors and large-scale processors of sensitive data, who are currently outside it. Third, Israel's European adequacy status, reaffirmed by the European Commission on 15 January 2024 and expected to be debated further in European Union institutions, is the load-bearing beam under the whole transfer regime — Israeli exporters rely on the European approved-country list through Regulation 2(8), and Israeli importers rely on adequacy in the other direction. On artificial intelligence, the Authority has published a guideline applying the Privacy Protection Law across the whole life cycle of an artificial intelligence system, from training to use, including that scraping personal data from the internet to train models requires informed consent and that publishing something about yourself online does not imply that consent; consultation on the draft closed 31 July 2025.