Israel

Europe's General Data Protection Regulation states which companies it covers. Israel's Protection of Privacy Law 5741-1981 has no such article. The Privacy Protection Authority published a professional guide on Amendment 13 in August 2025. It says only that the law applies to anyone who collects, uses or stores personal data. That covers public and private bodies. It leaves out a private collection not held for business or public purposes. So the reach over foreign companies comes from interpretation, not from the words of the law. The Authority's binding opinion of April 2026 on sending data abroad has a footnote on this. It says some databases held abroad may be subject to all of Israeli law. That can hold even where the company running them is not registered in Israel. The Authority opened an investigation into Facebook in 2018. Article 17B1 says who must appoint a Data Protection Officer. Public bodies. Data brokers holding data on more than 10,000 people. Companies whose main activity is regular and systematic monitoring of people, such as search engines and mobile operators. And companies that handle specially sensitive data at large scale, such as banks, insurers, general hospitals and health funds. There is a second, older role called the Data Security Officer, under Article 17B. It applies to anyone running five registrable databases, and to public bodies, banks, insurers and credit-rating firms.

Here is each industry, checked on 18 August 2026. BANKS: conditional. Bank of Israel Proper Conduct of Banking Business Directive 362, current version dated 17 June 2026, section 7. A bank may not store, move or use information it treats as sensitive on a cloud outside Israel. It may only do so once it has checked that the provider's protection meets the European General Data Protection Regulation. Section 38 adds a duty to plan for the foreign region going offline because of political events. INSURANCE AND PENSIONS: conditional, plus reporting. Capital Market, Insurance and Savings Authority circular 2018-9-35 on outsourcing applies to institutional bodies. The board must approve an outsourcing policy. It must deal specifically with work done outside Israel, or with a provider based outside Israel. You must assess what it means for the work to happen abroad. You must file an annual return to the Commissioner listing every outsourcing deal, with a yes or no field for whether it is abroad. You must report unusual events straight away. HEALTH: conditional on where the data goes, and closed on who controls it. Ministry of Health Director-General circular 2/2021 on cloud computing in the health system, section 6.5, allows cloud in a country that meets the transfer regulations. But circulars 1/2018 and 2/2018 on secondary use of health data go further. Patient data that names people and is used for research must stay in a secure space inside the health organisation. Sending it outside the organisation's control needs Helsinki-committee approval and a promise to destroy it. GOVERNMENT: closed. Under Project Nimbus, the state moved its own cloud landing zone out of an overseas public cloud. It moved into the new Israeli region as soon as that region opened. SECURITIES, TELECOMS, EDUCATION, GAMING, MAPPING AND DEFENCE. We found no rule requiring data to stay in the country on an Israeli government source. We checked on 18 August 2026. Confidence medium. The National Cyber Directorate's published map of cyber rules records that the Ministry of Communications has not issued any cyber rules for telecoms operators.

Regulation 1 of the Transfer of Data to Databases Abroad Regulations 5761-2001 sets the test for whether a country protects data well enough. Regulation 2 lists eight alternatives. The person consents. Or the transfer protects someone's life or health and you cannot get consent. Or you send to a company you control that has guaranteed privacy. Or the receiver signs a contract accepting the conditions that would apply to a database in Israel, with the changes needed to fit. Or the data is already lawfully public. Or the transfer is vital to public safety or security. Or Israeli law requires it. Or the country is party to the Council of Europe convention. Or it receives data from European Community member states under the same terms of acceptance. Or the Registrar has announced in the official gazette that it has a privacy authority Israel has a cooperation arrangement with. Regulation 3 adds a written guarantee on top of whichever route you use, including a promise not to pass the data on again. On 9 April 2026, updated 30 April 2026, the Privacy Protection Authority published its final binding opinion. It explains what 'with necessary modifications' means in the contract route. The contract must bind the receiver to four things. Use the data only for the stated purpose. Honour the right of access under Article 13. Honour the right of correction or deletion under Article 14. And keep the data confidential under Article 16. On security, the receiver must promise to meet the substance of the Data Security Regulations 5777-2017. Or it can declare that it holds ISO/IEC 27001 certification, including the Annex A controls. It must also promise the specific regulations listed in the Authority's Guideline 3/2018. The Authority accepts that Israeli database registration and notification duties need not be copied abroad where the destination has no similar duty. The opinion also confirms one more point. Say your Israeli database also holds data that arrived from the European Economic Area. Then the foreign receiver must also promise Regulations 3 to 7 of the 2023 European Economic Area regulations.

The Authority is headed by Commissioner Gilad Semama. Amendment 13 has been in force since 14 August 2025. It gave the Authority inspectors, powers to run inquiries, and powers to search and seize. It can also impose money penalties, order you to stop using data, and ask a court to order personal data deleted. As at 18 August 2026 it has published two decisions since Amendment 13. The first was against Meuhedet Health Fund. A technical fault let some members view other people's medical records. Regulation 11(d)(1) of the Data Security Regulations says you must report a severe security incident immediately. The fund learned of the fault in November 2025 but only reported it on 27 January 2026. The penalty started at 640,000 shekels (about 180,000 US dollars). It was cut by 60 percent to 256,000 shekels. The fund had no earlier breaches, stopped the problem on its own initiative and had appointed a privacy officer. The second decision was against A.D. Karting Hutzot (2014) Ltd. Its booking form collected personal data without the notice Article 11 requires. The penalty was 20,000 shekels, reduced to 12,000. We rate the Authority 'active' rather than 'aggressive'. It is clearly staffed. It has published a graduated scale of penalties and reductions, and it is using it. But the published caseload is still small and the first fines are modest.

The 24-month minimum comes from Regulations 10(d) and 17(a) of the Data Security Regulations 5777-2017. You must keep records from the access-monitoring system for 24 months, held securely. The same goes for data collected under the documentation, access-control, incident and outsourcing-control rules. Regulation 17(b) says medium and high security databases must back that up so it can always be restored. The duty to delete comes from the European Economic Area regulations of 2023. Regulation 4 requires a standing method, organisational or technical, that finds data you no longer need and deletes it at the earliest opportunity. Regulation 3 gives people a written right to erasure where data was collected unlawfully or is no longer needed for its purpose. When the two pull in opposite directions, keeping wins. Both regulations let you keep data you need for certain purposes. Meeting a legal duty. Running a legal case. Collecting a debt. Tackling fraud. Protecting a public interest, including archives and research. Or meeting an international agreement. Amendment 13 also pushes you to hold less data overall. The Authority's own guidance tells businesses to cut down existing data they no longer need. Israeli tax and company bookkeeping rules set their own longer minimum keeping times. We did not check those against an official source.

Regulation 11(d)(1) of the Data Security Regulations 5777-2017 sets the main duty. On a severe security incident you must immediately tell the Registrar. That is now the head of the Privacy Protection Authority. You must also report what you did about it. Under Regulation 11(d)(2), the Registrar may order you to tell a person who could be harmed. It must first consult the head of the National Cyber Defence Authority. 'Severe security incident' is defined narrowly. In a high-security database it means any unauthorised use of data, or damage to the integrity of data. In a medium-security database it means unauthorised use of a substantial part of the database, or damage to the integrity of a substantial part. Low-security databases are outside the duty. Israel spreads cyber rules across industry regulators on purpose. Government Resolution 2443 of 15 February 2015 chose to give powers to existing regulators rather than create a new one. So there is no single incident reporting deadline across the economy. Some industries do set deadlines. Insurers and pension bodies must report an unusual event to the Commissioner close to the time they learn of it. As of the National Cyber Directorate's current published map, the Ministry of Communications had still not published cyber rules for telecoms operators.

(1) Regulation 2(a)(2) of the European Economic Area regulations widens their reach. They cover 'any other data that is in a database in Israel that contains data' transferred from the European Economic Area. This has applied to mixed data since 1 January 2025. It also matters when you send data out. The Authority's April 2026 opinion makes the foreign receiver promise Regulations 3 to 7 as well. (2) The Meuhedet decision fined a two-month delay. (3) Article 23KF prices most breaches per person. It is 2 shekels per person, doubled to 4 for specially sensitive data. That band covers failures such as not appointing a data security officer or data protection officer. It is 4 shekels per person, doubled to 8 for specially sensitive data. That band covers using data for an unlawful purpose, or ignoring an order to stop. On a database of a million people holding sensitive data, the second band gives 8 million shekels, roughly 2.2 million US dollars. Registration breaches carry a flat 150,000 shekels (about 42,000 US dollars), doubled where the database covers a million people or more. Refusing to give an inspector documents carries 300,000 shekels (about 85,000 US dollars). (4) Article 5 makes deliberate invasion of privacy punishable by five years in prison. Amendment 13 added a chapter of database crimes. Using personal data from a database without permission from the company that holds it carries three years. Misleading someone when asking for their personal data carries three years. Unlawfully moving data out of a public body carries three years. (5) Article 17B, the data security officer, is triggered by holding five registrable databases, or by being a public body, bank, insurer or credit rater. Article 17B1 covers the data protection officer. It is triggered by being a public body. Or a data broker with more than 10,000 people. Or a systematic monitor. Or a large-scale handler of specially sensitive data. One more trap. Amendment 13 removed the short two-year time limit for civil privacy claims. Old exposure now runs for the ordinary time limit.

Dated items. 14 August 2025: Amendment 13 came into force, one year after it was published in the official gazette on 14 August 2024. 1 January 2025: the European Economic Area regulations were extended to mixed data. 9 April 2026, updated 30 April 2026: the final binding opinion on the contract route for sending data abroad. 16 April 2026: the Privacy Protection (Administrative Warning) Regulations 5786-2026 came into force. They let the Authority give a warning instead of a money penalty in four cases. Within three months of a new duty taking effect. On a first breach of certain data security regulations. For up to six months after the Authority tightens its enforcement policy in an area it had not enforced before. And for up to six months where the duty is unclear. A warning is only possible where a fine could lawfully have been imposed. Three things can change with no warning and no consultation. First, the Authority may announce in the official gazette that a named foreign country has a privacy authority it has a cooperation arrangement with. That would make the country a permitted destination overnight. We could not confirm whether any such announcement has been published. Second, the Minister of Justice may issue an order, with the approval of the Knesset Constitution Committee. It would extend the per-person money penalty for ignoring an order to stop or fix to systematic monitors and large-scale handlers of sensitive data. They are currently outside it. Third, Israel holds an official European decision that it protects data well enough. The European Commission reaffirmed it on 15 January 2024, and European Union bodies are expected to debate it further. Everything about sending data in and out rests on that decision. Israeli exporters use Europe's approved-country list through Regulation 2(8). Israeli importers rely on the decision in the other direction. On artificial intelligence, the Authority has published a guideline. It applies the Privacy Protection Law across the whole life of an artificial intelligence system, from training to use. It says scraping personal data from the internet to train models needs informed consent. Posting something about yourself online does not give that consent. Consultation on the draft closed 31 July 2025.