Cloud computing: legal and privacy issues

Service page: Digital commerce and AI lawyer: terms, privacy and direct mailing.

Cloud computing: who bears the legal liability when something goes wrong?

Israel has no specific law on cloud computing, but that does not mean there is a legal vacuum. The Protection of Privacy Law, 5741-1981, applies to anyone who holds a database that includes personal information, whether the server is in Tel Aviv or in Virginia. A cloud service provider that processes personal information for the client is a “holder” under the Law (an outside party that processes information for the controller of the database, section 3), and it too is responsible for the security of the information (section 17). The Protection of Privacy Regulations (Data Security), 5777-2017 set the standards for data security, including a duty to check once a year whether the information kept in the database is more than needed for its purposes (regulation 2(c)). The practical point: whoever moves data to the cloud does not move the liability; they keep it.

Amendment No. 13 to the Protection of Privacy Law, which came into force on 14 August 2025, significantly increased the powers of the Privacy Protection Authority: it may impose monetary sanctions, which in large databases are calculated by the number of people in the database and may reach millions of shekels (section 23Z). A privacy impact assessment (DPIA) is not a general duty under the Law, but it is recommended to carry one out before transferring sensitive information (medical, financial or biometric) to an outside provider.

What legal duties apply to you when you use a cloud service?

The Protection of Privacy Law imposes three main duties on anyone who uses cloud services to process personal information.

A practical checklist

1. The duty to inform: anyone who asks for personal information must state whether providing it depends on consent, for what purpose it is collected, to whom it will be given, who the controller of the database is and how to contact them, and that the data subject has a right of access and a right to ask for correction (section 11, as worded by Amendment No. 13); an invasion of privacy requires informed consent (sections 1 and 3).
2. The right of access: every person has a right to inspect the information about them in the database (section 13) and to ask for wrong information to be corrected or deleted (section 14).
3. Data minimization: processing is allowed only for the purpose of the database (section 8(b)), and you must check once a year that the information is not more than needed (regulation 2(c) of the Data Security Regulations). The agreement with the cloud provider should provide for the return and destruction of the information at the end of the engagement (regulation 15(a)(2)(d)).

Since Amendment 13, the registration duty applies only to a database whose main purpose is collecting information in order to give it to others as a business or for payment (when it contains information about more than 10,000 people) and to a database of a public body, and a database that contains information of special sensitivity about more than 100,000 people requires notice to the Authority (section 8A). Using cloud services does not exempt you from these duties: the database is the data, not the physical server that holds it. Many organizations miss this point and find themselves in a procedural breach even when their data security is excellent.

Data sovereignty: when the server is abroad, Israeli law applies

The Protection of Privacy Regulations (Transfer of Data to Databases Abroad), 5761-2001 (תקנות הגנת הפרטיות (העברת מידע אל מאגרי מידע שמחוץ לגבולות המדינה), התשס״א-2001) prohibit transferring personal information abroad unless the destination country provides an adequate level of protection, or a specific contract with equivalent protections has been signed. The Standard Contractual Clauses (SCC) that the large cloud providers offer are a tool of European law; against the Israeli regulations you must check separately that one of the conditions for transfer is met and that a written undertaking to safeguard the information has been obtained from the provider (regulation 3). “Large provider = I am safe” is not a legal defense.

Even when the servers are abroad, the Israeli Protection of Privacy Law applies to every Israeli organization that uses the service. The practical meaning: if the cloud provider suffers a severe security incident, the controller of the database (the client) must notify the Privacy Protection Authority immediately, and the Authority may order it to notify the data subjects (regulation 11(d)). The agreement with the provider should require it to notify the client of any security incident (regulation 15(a)(2)(h)). The due diligence before signing a cloud contract includes: checking the provider’s SOC 2 Type II or ISO 27001 certification, checking its breach notification policy, and verifying that the DPA meets Israeli requirements.

Data processing agreement (DPA)

Every agreement between a business and a cloud service provider that processes personal information must include a Data Processing Agreement (DPA). The DPA should include: the exact purpose of the processing, the processing instructions, the provider’s security assurances, how requests for access from data subjects are handled, and what happens to the data at the end of the engagement. The DPA is not just a formal document: it is the tool by which the organization proves that it took reasonable precautions.

In practice, many companies “accept” the standard cloud terms of Google, AWS or Microsoft without checking whether their DPA meets the Israeli requirements. Questions worth asking: does the DPA allow the provider to use the data to develop products? Is there a limit on where the servers are located? What is the timetable for returning the data at the end of the contract? Regulation 15 of the Data Security Regulations lists the subjects that must appear in the agreement with an outside party that gets access to the database, and it is the binding point of reference.

Which security measures must be taken under the 2017 Data Security Regulations?

The Protection of Privacy Regulations (Data Security), 5777-2017, set security levels (basic, medium and high), together with a database managed by an individual. A database that contains sensitive information (for example, medical, financial or criminal) is, as a rule, at least at the medium level, and at the high level when it contains information about 100,000 people or more or has more than 100 authorized users (the First and Second Schedules). At every level, transferring information over a public network or the internet must be done with accepted encryption (regulation 14(b)); encryption in storage as well is a recommended practice for a provider that handles sensitive information. The ISO/IEC 27001 standard, common among international cloud providers, provides an accepted framework for managing data security and is an indicator that the provider takes security seriously.

The duty to appoint a data security officer is set in section 17B of the Law (for example, for a public body, a bank, and a controller of five databases that require registration or notice), and a database at the high security level requires a risk survey and penetration tests at least once every 18 months (regulation 5(c)–(d)). When a business moves to a cloud environment, it does not leave these duties behind; it must make sure that the DPA with the cloud provider covers them expressly, including periodic penetration testing and SOC reports.

Example: which security level applies to a database in the cloud?

A clinic stores the medical files of 120,000 patients in the cloud.

1. Medical information is listed in item 1(3)(b) of the First Schedule to the Data Security Regulations.
2. Such a database, with information about 100,000 people or more, is subject to the high security level (Second Schedule, item (1)).
3. What this means: a risk survey and penetration tests at least once every 18 months (regulation 5(c)–(d)); automatic access logging kept for at least 24 months (regulation 10); an audit at least once every 24 months (regulation 16(a)); and a discussion of security incidents at least once a quarter (regulation 11(c)).
4. The cloud provider, as a holder, is also bound by the duties in the Regulations, except regulations 2 and 15(a) (regulation 19(a)), and the agreement with it should set how they will be implemented (regulation 15(a)(2)(e)).

A data breach in the cloud: who must report, and to whom?

The reporting duty is set in regulation 11(d) of the Data Security Regulations: in a severe security incident, you must notify the Privacy Protection Authority immediately and report to it on the steps taken, and the Authority may order that the data subjects who may be harmed also be notified. A “severe security incident” is defined by the security level: in a high-level database, any use of the information without authorization or any damage to its integrity; in a medium-level database, such an incident involving a substantial part of the database (regulation 1). It is worth setting in advance, in the agreement with the cloud provider, how soon it will notify you of an incident.

The practical rule: if the cloud provider notifies you of a breach, the clock is already ticking. Do not wait to check “exactly what the damage is” before you contact a lawyer. The duty in regulation 11(d) is to notify the Authority “immediately”, not at the end of the investigation.

Employee information in the cloud: what you must know

When a business moves information about employees to the cloud (payslips, medical information, performance reviews), it enters an area where the Protection of Privacy Law and employment law meet. Under the Protection of Privacy Law, an employee is entitled to know what is held about them and to demand access. The duty to inform in section 11 also applies toward employees: when personal information is requested from them, you must state for what purpose it is collected and to whom it will be given.

In practice, most employers add a clause on the use of digital tools to the employment contract. That is not enough on its own. When you move to a new cloud platform, it is worth updating the employee privacy policy and making sure that the DPA also covers the restrictions on using employee information. Employee information kept beyond the period it is needed (such as interview scores after hiring, or medical information after employment ends) may be “excess information” that should have been identified in the annual check (regulation 2(c)), even without any security incident.