Customer data leaked from the company: what the law requires, and the actual exposure

Service page: Defense against a motion to certify a class action.

A data leak starts as a technical question and ends as a legal one. In the first hours, management tries to understand what got out. At the same time, three exposures arise: toward the Privacy Protection Authority, toward the data subjects who may sue, and toward the group that may become a class action. All three rest on documents that are created, or not created, in those hours. This is what the law requires, in the words of the provisions themselves.

The first hour: what regulation 11 really requires

The duty to report an incident is not in the Law but in the regulations: the Protection of Privacy Regulations (Data Security), 5777-2017, made under section 36 of the Law. (Amendment 13 also added section 17(b) to the Law, which expressly gives the power to make regulations on data security.) This is the text:

Three practical conclusions. First, “immediately”: not 72 hours. If you manage the incident on the European timetable, you are late. Second, the notice to the Registrar is two duties, not one: notice of the incident, and a report on the steps taken after it. So documenting how the incident was handled is part of the duty itself. Third, notice to customers is not automatic. It comes, if at all, under an order of the Registrar under paragraph (2), after consulting the head of the Israel National Cyber Directorate. Of course, a company may notify on its own initiative, and sometimes there is a commercial and evidential reason to do so. But that is a decision, not a duty that arises from the incident itself.

And what being late costs: item (21) of the Third Schedule to the Law sets a monetary sanction for anyone who did not notify the head of the Authority immediately of a severe security incident, or did not report on the steps they took. It is NIS 80,000 for a database at the medium security level and NIS 320,000 at the high level. It is double that amount for a high-level database that holds information on 1,000,000 people or more (section 23Z(h)). These are the base amounts. Under section 23FF(b), they are updated by the index on 1 January each year, and in 2026 they are NIS 81,890 and NIS 327,560. The item speaks of notice “to the head of the Authority”: Amendment 13 replaced “the Registrar” with “the head of the Authority” in the Law (section 1(2) of the amending law).

What is required even before the incident, and what will be examined after it

Section 17(a) of the Law states that the controller of the database and its holder are each responsible for data security. The responsibility does not pass to the supplier. This gives three ongoing duties in regulation 11, and each of them becomes evidence on the day after:

• Documenting every security incident: every case in which an incident was discovered that raises a concern of harm to the integrity of the information, of its use without authorization, or of exceeding an authorization. This is done “as far as possible” on the basis of automatic logging (regulation 11(a)).
• A response procedure: the security procedure must include instructions for handling incidents according to their severity and the sensitivity of the information. This includes canceling permissions, other immediate steps, and reporting to the controller of the database (regulation 11(b)).
• A periodic discussion: in a database at the medium security level, a discussion of security incidents at least once a year. At the high level, at least once a quarter (regulation 11(c)).

In practice, these three are the list of documents that will be requested first in an administrative inquiry or a civil proceeding. A company that has no procedure, no log and no minutes of a discussion enters the incident without protection.

Amendment No. 13: what changed from 14 August 2025

The Protection of Privacy Law (Amendment No. 13), 5784-2024 was published in Sefer HaHukim 3287 on 14 August 2024. Section 74(a) of the amendment states that it comes into force “one year from the day of its publication”, that is, on 14 August 2025. These are the changes that directly concern a business that holds a customer database:

The duty to register was narrowed

Section 8A(a)(1) leaves a duty to register in two cases only. The first is a database whose main purpose is collecting personal information in order to pass it to another as a business or for consideration, including direct mailing services, and which holds information on more than 10,000 people. The second is a database whose controller is a public body as defined in paragraph (1) of the definition in section 23, unless it includes information only on that body’s employees. Most business customer databases no longer have to be registered. Under the transitional provision in section 76(a) of the amending law, a database that was registered on the commencement date stays registered even if it no longer has to be. That is, unless the controller notified the head of the Authority that the duty to register does not apply to it. Then it will be deleted from the register.

A new duty to notify, with a different threshold

Instead of registration, there is a duty to notify. Under section 8A(b)(1), anyone whose database (one that does not have to be registered) holds information of special sensitivity on more than 100,000 people must notify the Authority within 30 days. The notice gives the identity of the controller, its address and contact details, and the identity and contact details of the privacy protection officer, if one must be appointed. A copy of the database definitions document must also be provided. Section 8A(b)(2) adds a duty to update within 30 days on any change in these details and on the end of the database’s activity.

A privacy protection officer

Section 17B1(a) requires four groups to appoint a privacy protection officer. The first is a public body (except a security body). The second is a database controller whose main purpose is collecting information in order to pass it to another as a business or for consideration, with more than 10,000 people. The third is anyone whose main activities involve processing information that requires ongoing and systematic monitoring of people on a significant scale, including a mobile phone provider and an online search service provider. The fourth is anyone whose main business includes processing information of special sensitivity on a significant scale, including a banking corporation, an insurer, a general hospital and a health fund (kupat holim). Section 17B1(b) sets out the tests for “a significant scale”.

The officer is not a symbolic role. Section 17B2 requires the controller to provide the officer with the conditions and resources for the role, and to make sure the officer is properly involved in every matter that concerns privacy protection law. It also states that the officer reports directly to the CEO, or to an employee who reports directly to the CEO. Section 17B3 requires in-depth knowledge of privacy protection law, an understanding of technology and data security, and familiarity with the body’s activity. It allows the officer not to be an employee of the body. It forbids the officer to hold another role, or to report to an officer of the company, in a way that may put them at risk of a conflict of interest.

The monetary sanction: the amounts in the Law

Chapter D3 of the Law, added by Amendment No. 13, sets up an administrative enforcement system. Section 23Z does not set a “fine for a leak”. It sets different amounts according to the type of breach. These are the amounts in the words of the section, that is, the base amounts. Under section 23FF(b), they are updated by the consumer price index on 1 January each year, starting in 2026. The head of the Authority publishes the updated amounts in Reshumot and on the Privacy Protection Authority’s website (section 23FF(c)):

The amounts for 2026: under section 23FF(b), the amounts in the table are updated on 1 January each year. From 1 January 2026 they are NIS 153,540 (double: NIS 307,080); NIS 15,350; NIS 51.18 and NIS 102.36 per person, with a floor of NIS 30,710; NIS 2.05 and NIS 4.09 per person, with a floor of NIS 20,470 or NIS 40,940; NIS 4.09 and NIS 8.19 per person, with a floor of NIS 204,720; and NIS 307,080 (notice on the update of the monetary sanction amounts, Yalkut HaPirsumim 15000, 7 October 2026 (in Hebrew)). The “floor” is the amount the head of the Authority may impose when the amount calculated by the number of people is lower than it.

Note the structure: two rows in the table are calculated by the number of people in the database, not as a fixed amount. In an organization that holds information on hundreds of thousands of customers, a sanction of “NIS 2 per person” is not a small sum. This, and not a fixed amount, is what makes not appointing an officer a real financial risk.

Reductions and caps: what changes the actual amount

The Fifth Schedule to the Law sets a reduction mechanism that is worth knowing before you send a reply to the Authority:

• No earlier enforcement: 20% if, in the five years before the breach, no sanction or administrative enforcement measure was imposed for breaching the same provision, and 10% if this was so in the three years before it.
• Stopping on the violator’s own initiative and self-reporting to the head of the Authority: 30%. This is the largest of the fixed-rate reductions on the list, and it is exactly what is decided in the first hours.
• Actions to prevent a repeat and to reduce the damage, to the satisfaction of the head of the Authority: 20%.
• Appointing a privacy protection officer, by someone who must do so under section 17B1(a)(3) and (4) only, before the notice of intent to impose a sanction is delivered: 10%.
• Compensation paid or awarded against the violator for the same breaches: up to 30%.
• The combined reduction from all of these will not exceed 70% of the sanction amount.

Alongside the reductions, there are caps. A “micro business” is one whose turnover in the year before the breach did not exceed NIS 4 million. A “small business” is one whose turnover exceeded NIS 4 million and did not exceed NIS 10 million. At the violator’s request, the amounts are reduced for it so that they do not exceed NIS 20,000 (micro) or NIS 40,000 (small) for breaches under section 23Z(a) and (b); NIS 50,000 or NIS 100,000 for breaches under subsections (c) to (f); and NIS 70,000 or NIS 140,000 for a breach under subsection (g). In 2026, the caps are NIS 20,470 or NIS 40,940, NIS 51,180 or NIS 102,360, and NIS 71,650 or NIS 143,310. In addition, under section 7 of the Fifth Schedule, if the sanction amount exceeds 5% of the violator’s turnover, it will be reduced to that rate. This is done at the violator’s request, with a confirmation from a CPA or a representative tax adviser, filed within 30 days of delivery of the notice of intent to impose a sanction.

The civil exposure: section 29A

Section 29A(b)(1) allows the court to order a defendant in a civil claim under section 4 of the Law to pay compensation without proof of damage. Under paragraph (2), it can order double that amount when it is proved that the invasion of privacy was done with intent to harm. The amount stated in the Law is NIS 50,000. But section 29A(d) links it to the consumer price index and updates it on the 16th of each month, with the May 2007 index as the base index. As of the update of 16 October 2026, the cap is NIS 72,221.22, and double the amount is NIS 144,442.44. Section 29A(c) adds that compensation without proof of damage will not be awarded more than once for the same invasion of privacy.

In a class action, by contrast, the court will not award compensation without proof of damage, although this does not prevent compensation for damage that is not financial (section 20(e) of the Class Actions Law). So multiplying the number of class members by the linked cap is not a measure of the exposure in such a claim. See more on this in the class action route for a customer data leak.

The class action exposure: the gateway, the tests and the remedies

A point that is often missed: the Protection of Privacy Law has no class action provision of its own, and the Second Schedule to the Class Actions Law has no item dedicated to invasion of privacy. The usual gateway is item 1: “a claim against a dealer, as defined in the Consumer Protection Law, in connection with a matter between it and a customer, whether or not they entered into a transaction”. So the first question in every such motion is whether the defendant is a dealer and whether the applicant is its customer, not only whether the information leaked.

Certification of the motion depends on the four cumulative conditions in section 8(a) of the Law. There must be material questions of fact or law common to all the class members, with a reasonable possibility that they will be decided in the class’s favor. A class action must be the efficient and fair way to decide the dispute. There must be reasonable grounds to assume that the class members’ interests will be represented and managed in an appropriate way. And there must be reasonable grounds to assume that it will be managed in good faith. In data leak cases, the first condition is the battlefield: the damage, and mainly proving it as a question common to the whole class and not as an individual question for each person harmed.

And if the class action is decided in the class’s favor, section 20 sets how the remedy is given. The court may order compensation for everyone who proved entitlement, order that each class member prove their own entitlement, or order monetary compensation in a total amount when it can be calculated precisely on the basis of the evidence. Under section 20(c)(1), when monetary compensation to the class members is not practical, whether because they cannot be identified and paid at a reasonable cost or for another reason, the court may order any other remedy in favor of the class or of the public. A monetary remedy in favor of the public is transferred to a fund set up under section 27A.

Four claims that keep coming up on this subject, and are not true

“There are 72 hours to report.” There are not. The 72 hours are a rule of the European GDPR. Israeli law requires notice “immediately” under regulation 11(d)(1). This is a stricter requirement, not a more lenient one.

“You must notify all customers right away.” No. Notice to the data subjects is given under an order of the Registrar, under regulation 11(d)(2), after consulting the head of the Israel National Cyber Directorate.

“The fine for a data leak is NIS 500,000.” The Law has no such amount and no “fine for a leak”. Section 23Z sets different amounts according to the type of breach: NIS 15,000, NIS 150,000, NIS 300,000, amounts based on the number of people in the database, and an amount of NIS 30,000 or NIS 200,000 that the head of the Authority may impose when the calculated amount is lower. For a breach of the security regulations, the amounts in the Third Schedule apply, according to the security level.

“Every business with a customer database must register it.” Not since 14 August 2025. Section 8A(a)(1) narrowed the duty to register to two cases only, and most business customer databases are not included in them. What was added is the duty to notify in section 8A(b), with a threshold of 100,000 people for information of special sensitivity.

The order of actions in the first week

• Decide whether the incident is “severe”: this decision determines whether the duty of immediate notice has arisen. It is documented with the reasoning and the time.
• Freeze the evidence: logs, configurations, backups, correspondence. Regulation 11(a) already requires documentation; in an incident, the scope grows.
• Notify the Authority and document the steps: the two duties in regulation 11(d)(1). At the same time, this is the basis for the 30% reduction for stopping on the violator’s own initiative and self-reporting.
• Close the breach and prove it: a further 20% reduction depends on actions to prevent a repeat and to reduce the damage, to the satisfaction of the head of the Authority.
• Map the database: how many data subjects, which types of information, whether there is “information of special sensitivity”, and which security level applies. These are the variables that set both the sanction amount and the size of the potential class.
• Check the supplier chain: section 17(a) places responsibility on the controller and on the holder. A contract with a supplier does not transfer the responsibility, but it does set how the damage is shared.
• Coordinate messages: a notice to the public, to business customers and to other regulators is worded once. Wording drafted before the facts are mapped is a common source of further exposure.

Frequently asked questions

How soon must a company report a data leak?

Regulation 11(d)(1) of the Protection of Privacy Regulations (Data Security), 5777-2017 states that in a severe security incident, the controller of the database must notify the Registrar “immediately”, and must also report to the Registrar on the steps it took after the incident. Israeli law has no fixed 72-hour deadline as in the European GDPR, and the wording “immediately” is stricter, not more lenient. A separate duty to notify, within 30 days, applies under section 8A(b) of the Protection of Privacy Law to anyone who holds information of special sensitivity on more than 100,000 people in a database that does not have to be registered. But that is notice of the existence of the database, not of an incident.

Do you have to tell customers that their data leaked?

Not automatically. Regulation 11(d)(2) gives the Registrar, not the company, the power to order the controller of the database to notify a data subject who may be harmed by the security incident. This is done after consulting the head of the Israel National Cyber Directorate. So notice to customers is not an independent duty that arises from the incident itself. It derives from the Registrar’s order. At the same time, a company may notify on its own initiative, and sometimes there is a commercial and evidential reason to do so. Such a decision is also weighed against other disclosure duties that may apply to the company under another law or under a contract.

How large a monetary sanction can be imposed on a company for breaching the Protection of Privacy Law?

Section 23Z of the Protection of Privacy Law, 5741-1981, as worded by Amendment No. 13, sets different amounts according to the type of breach. NIS 150,000 for processing information in a database that must be registered without registering it, and for other registration and notice breaches, and double the amount if the database holds personal information on one million people or more. NIS 15,000 for refusing to allow inspection and for similar breaches. NIS 50 for each person approached without the notice required by section 11, or NIS 100 per person for information of special sensitivity; if the total is lower than NIS 30,000, the head of the Authority may impose NIS 30,000. NIS 2 for each person whose information is in the database, or NIS 4 for information of special sensitivity, for breaches that include not appointing a data security officer or a privacy protection officer. NIS 4 for each person whose information is in the database, or NIS 8 for information of special sensitivity, for the breaches in section 23Z(e), which include processing information for a purpose that is not lawful; if the total is lower than NIS 200,000, the head of the Authority may impose NIS 200,000. For a breach of the Data Security Regulations, the amounts in the Third Schedule apply, according to the security level that applies to the database. The Law has no uniform amount of NIS 500,000 for a data leak. These are the base amounts in the Law. Under section 23FF(b), they are updated on 1 January each year. In 2026 they are, for example, NIS 153,540 instead of NIS 150,000, NIS 51.18 instead of NIS 50 per person, and NIS 204,720 instead of NIS 200,000 (Yalkut HaPirsumim 15000, 7 October 2026).

How is a company sued in a class action over a data leak?

The Protection of Privacy Law has no class action provision of its own, and the Second Schedule to the Class Actions Law, 5766-2006 has no item dedicated to invasion of privacy. So the usual gateway is item 1 of the Second Schedule: a claim against a dealer as defined in the Consumer Protection Law, 5741-1981, in connection with a matter between it and a customer, whether or not they entered into a transaction. Certification of the motion depends on the four conditions in section 8(a): material questions common to all the class members, with a reasonable possibility that they will be decided in the class’s favor; the efficiency and fairness of a class action; appropriate representation and management; and management in good faith. If the class action is decided in the class’s favor, section 20 sets how the remedy is awarded. Under section 20(c), when individual compensation is not practical, the court may order a remedy in favor of the class or of the public, to be transferred to the fund under section 27A.

Which databases must be registered after Amendment 13?

Section 8A(a)(1) of the Law, as worded by Amendment No. 13, narrowed the duty to register to two cases. The first is a database whose main purpose is collecting personal information in order to pass it to another as a business or for consideration, including direct mailing services, and which holds personal information on more than 10,000 people. The second is a database whose controller is a public body as defined in paragraph (1) of the definition in section 23, unless the database includes information only on that body’s employees. Most business customer databases are no longer included in the duty to register. Under the transitional provision in section 76(a) of the amending law, a database that was registered on the commencement date stays registered even if it no longer has to be registered. That is, unless the controller notified the head of the Authority that the duty to register does not apply to it.

What actually brings an organization down in an administrative inquiry by the Privacy Protection Authority?

Documents and procedures, not only the incident itself. According to the Authority’s announcement of 16 September 2026, checked on 17 October 2026, a sanction of NIS 64,000 was imposed on the Beit Shemesh Municipality. It was for breaching regulation 2(a)(7) of the Protection of Privacy Regulations (Data Security): an external supplier that had ongoing access to the database was not listed as a holder in the database definitions document. It was also for breaching regulation 15(a)(3), because the data security procedure did not regulate the contracts with external parties that have access. The argument of an “administrative gap in good faith”, because Amendment 13 came into force about a week before the incident, was rejected, since the bodies had had a year to prepare.