Transferring data abroad: duties and restrictions

Service page: Digital commerce and AI lawyer: terms, privacy and direct mailing.

How Israeli law regulates transferring data abroad

Transferring personal or proprietary information abroad has significant legal consequences under Israeli law. The legal basis for controlling such a transfer is mainly the Protection of Privacy Law, 5741-1981, together with the Protection of Privacy Regulations (Transfer of Data to Databases Abroad), 5761-2001. The Protection of Privacy Law protects every person’s right to privacy and places various duties of care on those who hold information about them. This includes information that a person kept private, or information collected about them by a government or commercial organization. Transferring such information abroad takes it outside the protection of Israeli law, so the Regulations make it subject to conditions.

The provisions of the Protection of Privacy Regulations (transfer of data abroad)

The Protection of Privacy Regulations (Transfer of Data to Databases Abroad) set a clear framework. Regulation 1 prohibits transferring information from a database in Israel abroad unless the law of the destination country ensures a level of protection no lower than that of Israeli law: lawful and fair collection and transfer, use for the purpose for which it was collected, accuracy and being up to date, a right of access and correction, and security measures. Regulation 2 lists exceptions, any one of which is enough: the consent of the person the information is about; a transfer necessary to protect their health when consent cannot be obtained; a transfer to a corporation controlled by the database controller, which has ensured the protection of privacy; a contractual commitment by the recipient to meet the conditions of Israeli law; information published lawfully to the public; a transfer required to protect public safety or under law; or a transfer to a country that is a party to the European Convention for the Protection of Individuals (Convention 108), to a country that receives information from the European Union on the same terms, or to a country that the Registrar of Databases announced in Reshumot (the official gazette). The principle of data minimization (transferring only what is needed) is a recommended practice that reduces exposure.

Conditions about countries and types of information

Israel has no official list of “adequate countries”: anyone who relies on regulation 1 must show on their own that the law of the destination country meets the standard, and in practice most transfers rely on the exceptions in regulation 2: consent, corporate control or a contractual commitment. This rule is especially significant when transferring to countries that have no comprehensive privacy legislation. Information of special sensitivity (medical, biometric, about sexual orientation or about religious belief) calls for a more careful check and stronger security measures before the transfer.

Accuracy of the information and the conditions of the transfer

Every transfer of information must be done carefully and professionally. The transferring organization must ensure: (1) that the information is accurate and up to date; (2) that the information is secured at the level required by the Protection of Privacy Regulations (Data Security), 5777-2017, including encryption by accepted methods when the information is transferred over a public network or the internet (regulation 14(b)); (3) that there is a written undertaking by the recipient abroad about securing and handling the information (regulation 3); (4) that the information will not be transferred to a third party, in the same country or in another country.

Also remember the database definitions document: under regulation 2(a)(4) of the Data Security Regulations, the database controller must detail in it every transfer of the database, or of a substantial part of it, outside Israel, and every use of the information outside Israel (the purpose of the transfer, the destination country, the manner of transfer and the identity of the recipient), and must update the document when a significant change is made (regulation 2(b)). A missing document is a breach for which a monetary sanction is set in item (1) of the Third Schedule to the Protection of Privacy Law: the base amount ranges from NIS 2,000 to NIS 160,000 depending on the security level of the database, and it is updated by the index on 1 January each year (section 23FF(b)).

The rights of the person whose information is transferred

A person whose information is transferred abroad has important rights under the Protection of Privacy Law.

A practical checklist

1. Under the Protection of Privacy Law, a person has the right to know which parties hold information about them and for what purpose it is used, including its transfer abroad.
2. A person has the right to ask to inspect the information held about them and to demand that it be corrected if it is wrong.
3. A person who believes that information about them was transferred abroad without authorization or in breach of an agreement can file a complaint with the Privacy Protection Authority.
4. The rights of access and correction (sections 13–14 of the Law) apply even when the information is actually held by a recipient abroad. The responsibility for giving effect to them stays with the database controller in Israel.

The data subject’s consent and the nature of the agreement

When the transfer relies on the data subject’s consent (regulation 2(1)), the consent must be “informed consent” as defined in section 3 of the Protection of Privacy Law, meaning given after the person understood to whom the information is transferred, to which country and for what purpose. Consent forced as a condition for receiving a service that does not depend on the transfer (“take-it-or-leave-it”) is open to the argument that it is not freely given, so it is better to base routine transfers on a contractual commitment by the recipient and not on consent alone.

Contractors abroad: what must the contract include?

In some cases, an Israeli business or organization needs to transfer information to a contractor abroad (such as a cloud service, outsourced support services, or a laboratory abroad). Under regulation 3 of the Regulations, the transferring party must obtain a written undertaking from the foreign contractor to take sufficient measures to ensure privacy and not to transfer the information to anyone. When the contractor receives access to the database, regulation 15 of the Protection of Privacy Regulations (Data Security), 5777-2017 requires the agreement to set out, among other things: (1) the information it may process and the purposes for which it is used; (2) the database systems it may access and the type of processing allowed; (3) how the data security duties are carried out and how its employees sign a confidentiality undertaking; (4) the term of the engagement, and the return and destruction of the information when it ends; (5) conditions for engaging a subcontractor; (6) a report at least once a year and notice of a security incident. The transferring party remains responsible toward the data subjects even when the failure happened at the contractor.

Legal risks and reporting duties

When personal information is provided abroad and is then hacked, stolen or misused, the responsibility stays with the database controller in Israel. Under the Data Security Regulations, a severe security incident requires an immediate report to the Privacy Protection Authority, which may order that the data subjects be notified as well. Since Amendment No. 13 to the Protection of Privacy Law (in force since August 2025), the Authority has the power to impose monetary sanctions for breaches, alongside civil claims by data subjects who were harmed.

Israel versus the GDPR: what changes?

The European Union recognizes Israel as a country with an adequate level of protection (an adequacy decision from 2011, reaffirmed in January 2024), so data can flow from the EU to Israel without special approvals. At the same time, the Protection of Privacy Regulations (Provisions Regarding Information Transferred to Israel from the European Economic Area), 5783-2023 (תקנות הגנת הפרטיות (הוראות לעניין מידע שהועבר לישראל מהאזור הכלכלי האירופי), התשפ״ג-2023) place additional duties on a database controller in Israel that holds information originating in the European Economic Area: deleting or anonymizing information that is no longer needed, keeping it accurate, and notifying the data subjects. An Israeli business that passes such information on to a third country must meet both the Israeli requirements and the law of the destination country.

Frequently asked questions

The company uses a well-known cloud provider. Is that enough?

No. The contract with the cloud provider must contain specific clauses under regulation 3 of the Regulations on transferring data abroad: a written undertaking by the recipient to take sufficient measures to ensure privacy and not to transfer the information to anyone, and not only a DPA.

Is the customer’s consent enough to transfer their data abroad?

Not always. When the transfer relies on the data subject’s consent (regulation 2(1)), the consent must be “informed consent” (section 3 of the Protection of Privacy Law), given after the person understood to whom the information is transferred, to which country and for what purpose. Consent forced as a condition for receiving a service that does not depend on the transfer is open to the argument that it is not freely given, so it is better to base routine transfers on a contractual commitment by the recipient.

The data leaked at the contractor abroad. Who is responsible?

The responsibility stays with the database controller in Israel. A severe security incident requires an immediate report to the Privacy Protection Authority, which may order that the data subjects be notified as well, and since Amendment No. 13 the Authority has the power to impose monetary sanctions, alongside civil claims by data subjects who were harmed.