Cyber and data security law in Israel 2026: what every startup needs to know

Service page: Digital commerce and AI lawyer: terms, privacy and direct mailing.

Is your startup subject to cyber requirements?

Privacy protection and data security law in Israel applies to every company that processes personal information, whatever its size or stage of development. “We didn’t know” is no longer accepted as an excuse.

The reason for the tighter regulation is simple. Breaches keep growing, the harm to citizens’ privacy keeps increasing, and new laws come to protect the owners of information from irresponsible conduct by businesses. Any data leak, even a small one, can cause significant harm and lead to serious legal violations.

Which laws apply to technology companies in Israel?

In recent years, the Israeli government has tightened cyber requirements in various laws and regulations. The Israel National Cyber Directorate sets the national policy and the protection guidelines. The main binding framework is:

• Protection of Privacy Law, 5741-1981: the basic framework for protecting personal information, including rights of access and correction, and the lawfulness of processing.
• Protection of Privacy Regulations (Data Security), 5777-2017: binding data security requirements for every database controller, private and public, on a scale of four security levels (basic, medium, high, and a database of an individual), according to the amount of information and how sensitive it is.
• Breach reporting duties: a severe security incident is reported to the Privacy Protection Authority immediately. Notice to the data subjects is required only if the Authority has ordered it (regulation 11(d)).
• Requirements of government ministries: government ministries have strict security requirements that affect suppliers and subcontractors.

What must an Israeli technology company actually do under cyber and privacy law?

1. Risk checks and security assessments

Every company that processes sensitive data should carry out periodic risk assessments and evaluate the cyber threats it faces. This includes identifying weak points in the infrastructure, the software and the management processes. Under regulation 5 of the Regulations, a database at the high security level must carry out a risk survey and penetration tests at least once every 18 months, discuss the results and correct the defects. At every security level, the controller must keep a database definitions document (regulation 2). At every level except a database managed by an individual, a documented security procedure is also required (regulations 4 and 21).

2. Breach reporting

When there is a breach or a cyber attack that puts personal data at risk, the company must:

• Notify the Privacy Protection Authority immediately of a severe security incident, and report to it on the steps taken (regulation 11(d) of the Data Security Regulations). A “severe security incident” is use of the information without authorization, or harm to its integrity. In a high-level database, this means any such incident. In a medium-level database, it means an incident that concerns a material part of the database.
• Notify the data subjects who may be harmed, if the Authority has ordered it after consulting the Israel National Cyber Directorate (regulation 11(d)(2)).
• Document all the details: who started the breach, which data was exposed, and which steps were taken as soon as possible.

3. Appointing a data security officer and a privacy protection officer

Section 17B of the Protection of Privacy Law requires the appointment of a data security officer in public bodies, in banks and insurance companies, and by anyone who controls five databases that are subject to registration or notice. Amendment 13 added a duty to appoint a privacy protection officer (section 17B1). This applies, among others, to anyone whose main business involves systematic monitoring of people on a significant scale, or trade in personal information about more than 10,000 people. A startup that does not have this duty should still appoint a person responsible for security, to handle procedures, updates, training and incidents.

What is the sanction on a company that does not meet the data security and privacy requirements?

The sanctions for breaches of cyber laws in Israel are getting tougher. The Privacy Protection Authority can impose:

• Administrative fines: monetary sanctions under Amendment 13. The amount depends on the type of breach and the size of the database, and it can reach considerable sums in large databases or in repeated breaches.
• Orders to correct and to comply with regulation: a demand to correct systems and processes so that they comply with the regulatory requirements.
• Public notice: publication on the Authority’s website of the sanction, the nature of the breach, the amount of the sanction and, as a rule, also the name of the violator when it is a corporation, for a period of four years (section 23TT). Such publication can significantly harm the company’s business reputation.
• Civil liability: individuals harmed by a breach can file claims for compensation for the damage caused to them.

Startups that neglect cyber security mainly risk harm to their reputation, failed deals, and a lower valuation in the eyes of investors and others.

Are you allowed to enter customers’ personal data into a generative AI tool?

Entering personal information from the customer database into an external AI tool is “processing” of the information. The definition in section 3 of the Protection of Privacy Law also includes transfer, disclosure and giving access. So it is allowed only for the purpose of the database that was lawfully set for it (section 8(b)). When the tool’s provider processes the information for the company, it can be treated as a “holder” (section 3). If the service involves giving access to the database, the security risks must be assessed in advance. The agreement must set out the information that may be processed, the purposes of use and the security measures (regulation 15 of the Data Security Regulations). When the servers are outside Israel, the regulations on transferring data abroad also apply. It depends on the circumstances, but it is usually better to enter information from which identifying details have been removed, and to set out in the security procedure which tools are allowed.

Where do you start: the minimum list of actions to comply with cyber law in Israel?

To meet the regulatory requirements, startups need:

• Data mapping: a full review of which data is processed, how it is stored, and exactly who has access to it.
• Documented policies and processes: document clear cyber policies, periodic access reviews, data encryption, and incident handling.
• Broad staff training: every employee needs basic training in recognizing phishing, using strong passwords, and handling sensitive data.
• Software updates and security patches: keep operating systems, communication components and third-party software updated on an ongoing basis.
• External testing: consider cyber testing contractors or periodic code audits.
• Cyber insurance: look into cyber insurance that covers the costs of responding to a breach or a cyber incident.

Startups that prepare for cyber requirements early do not only avoid fines. They build a competitive advantage. Customers, partners and investors want to know that their information is protected. Good security is already part of the pitch.