Data retention: duties and periods

Service page: Digital commerce and AI lawyer: terms, privacy and direct mailing.

Data retention duties under various laws in Israel

The Protection of Privacy Law, 5741-1981, has no absolute and clear-cut requirement to keep information for a certain period. Still, the Law limits the use of information to the purpose for which the database was set up (section 8(b)), and the Protection of Privacy Regulations (Data Security), 5777-2017, require the database controller to check once a year whether the information it keeps is more than required for the purposes of the database (regulation 2(c)). This is the “data minimization principle”. In other words: more information = more legal risk.

Various laws in Israel set different retention requirements depending on the type of data:

Tax and bookkeeping data: the Income Tax Instructions (Bookkeeping), 5733-1973 (הוראות מס הכנסה (ניהול פנקסי חשבונות), התשל״ג-1973) provide (section 25) that the accounting system must be kept for seven years from the end of the tax year to which it relates, or six years from the day the income report for that year was filed, whichever is later. This includes the books of account, the invoices and the receipts.

Bank data: the Prohibition on Money Laundering (The Banking Corporations’ Requirements regarding Identification, Reporting, and Record-Keeping for the Prevention of Money Laundering and the Financing of Terrorism) Order, 5761-2001, requires a bank to keep the customer’s identification documents for at least seven years after the account is closed, and the records of transactions for at least seven years from the day the transaction was recorded.

Employment data: the Wage Protection Law, 5718-1958 (section 24) requires an employer to keep a wage ledger, and the Hours of Work and Rest Law, 5711-1951 requires a record of working hours. The law does not set a uniform retention period for an employee file, but in practice the records are usually kept for at least seven years from the end of employment (the general limitation period under the Prescription Law, 5718-1958), because that is the period in which an employee may still sue.

Health data: the Public Health Regulations (Keeping of Records), 5737-1976 (תקנות בריאות העם (שמירת רשומות), התשל״ז-1976) require a hospital to keep a patient’s medical records for 20 years after the last hospitalization or treatment, and to keep the file of a patient in the hospital’s outpatient clinic for 7 years after the last treatment. This is a strict requirement, among other reasons because of the risk of medical claims that come to light only years after the treatment was given.

Data security records: here the risk is the reverse: keeping data for too short a time is the breach. In a database to which a medium or high security level applies, the records of the mechanism that controls access to the database (who accessed it, when, which component, and whether access was approved or refused) must be kept for at least 24 months (regulation 10(d) of the Data Security Regulations). Data collected in carrying out the security duties, including the records of security incidents (regulation 11), is kept securely for 24 months, in every database that is not a database managed by an individual (regulations 17(a) and 21).

Case study: retention periods at an e-commerce company

Think of an ordinary online shop. What does it need to keep?

• Basic customer data: name, address, phone, email, for as long as they are needed to handle the order, complaints and returns, or until a pending legal proceeding ends
• Transaction data: order number, price, date, for seven years from the end of the tax year, under the bookkeeping instructions
• Payment records: the payment vouchers are kept with the bookkeeping documents; there is no reason to keep full credit card details after the transaction is completed, unless the customer asked to save a payment method for future purchases
• Records of inquiries and complaints: the record of how they were handled and resolved, until the end of the limitation period, if a legal proceeding is expected
• Registration data: user name and encrypted password, until the account is closed, and after that only if there is a defined need (for example, fraud prevention) and for a fixed period

If a company keeps this information longer than required, it holds “excess information” contrary to the duty of annual review in the Data Security Regulations, and it increases the damage and the legal exposure if there is a leak. For example, keeping the credit card details of a customer who has not made a transaction for two years is an unnecessary risk: toward the customer, toward the credit card company and toward the Privacy Protection Authority.

Higher requirements for sensitive data

Certain types of data require shorter retention periods or special treatment:

Genetic and biometric data: the Protection of Privacy Law defines genetic information and a biometric identifier as “information of special sensitivity” (section 3), so stricter security requirements apply to them, and genetic information is also subject to special provisions in the Genetic Information Law, 5761-2000 (חוק מידע גנטי, התשס״א-2000). The retention period should be the shortest that the purpose of the collection requires. For example, a fingerprint scan kept for entry to the office should be deleted when the employee leaves, because the purpose has then been exhausted.

Other sensitive data: data on mental health, criminal history and religion must be protected to the highest degree. Retention periods should be shorter, and sometimes the data must be deleted as soon as the purpose for which it was collected has been achieved.

An up-to-date retention plan and proper deletion

A company should have a written data retention policy. The plan should include:

• The different types of data (registration, transactions, health, etc.)
• The retention period for each type
• The legal basis for this period (tax, money laundering, health, limitation period)
• A deletion process (exactly how the data will be deleted: permanently, marking as “deleted”, or physical burning)
• A person responsible for deletion
• A record of every deletion (for regulatory audit purposes)

When deleting, you must make sure that the data cannot be restored. Simple deletion in the file explorer is not enough; you need to use a secure deletion tool. In large companies, it is advisable to have a third party verify the deletion, to prove that it was carried out.

Which data requires an especially short retention period?

Business owners should check whether certain types of data should be kept only for the shortest possible period:

Location data: if a company with a mobile app keeps location data for traffic analysis, it may keep it only as long as the data serves a clear purpose (for example, until the analysis for which it was collected is finished). After that, delete it.

Footage from security cameras: the footage must be kept only for a short period, as required for the security purpose for which the cameras were installed. Keeping it longer is considered “excess”.

Phishing messages: if an employee receives a suspicious email, it should be forwarded to the security team and deleted after it has been dealt with.

Deletion as a right of the individual

The Protection of Privacy Law does not provide a general “right to be forgotten”, but section 14 of the Law gives every person who inspected the information about them and found that it is not correct, complete, clear or up to date the right to apply to the database controller with a request to correct the information or delete it. Under regulation 7 of the Protection of Privacy Regulations (Conditions for Inspection of Information and Procedure for Appeal against a Refusal of a Request for Inspection), 5741-1981 (תקנות הגנת הפרטיות (תנאים לעיון במידע וסדרי הדין בערעור על סירוב לבקשת עיון), התשמ״א-1981), a database controller that refuses to correct or delete the information must notify the applicant of this within 30 days from the day the request was received, and failing to answer within this period is treated as a notice of refusal (see also section 14(c) of the Law); and since Amendment No. 13, the court may award exemplary damages of up to NIS 10,000 to a person who did not receive such a notice (section 15A). Even when there is no legal duty to delete, keeping information whose collection purpose has been exhausted is contrary to the data minimization principle, so an organization that receives a deletion request should check whether there is a retention duty that overrides it (such as a retention duty for tax purposes), and if there is none, delete.

An important exception: personal information transferred to Israel from the European Economic Area (the EU countries, Iceland, Norway and Liechtenstein), except information that a person provided directly about themselves, is subject to the Protection of Privacy Regulations (Provisions Regarding Information Transferred to Israel from the European Economic Area), 5783-2023 (תקנות הגנת הפרטיות (הוראות לעניין מידע שהועבר לישראל מהאזור הכלכלי האירופי), התשפ״ג-2023). Under them, the database controller must operate a mechanism that ensures that information no longer needed is not held, and delete such information at the earliest possible time (regulation 4); and at the written request of the data subject, it must delete information that was collected unlawfully or that is no longer needed for its purpose, unless one of the exceptions applies, for example fulfilling a legal duty or conducting a legal proceeding (regulation 3).

Frequently asked questions

How long must tax documents, bank records and employee files be kept in Israel?

Bookkeeping documents are kept for seven years from the end of the tax year (or six years from the day the report was filed, whichever is later), bank records for seven years under the anti-money laundering order, and employee files are usually kept for seven years from the end of employment, the general limitation period. An inpatient’s medical record is kept for 20 years. Each type of information is subject to a different retention period set in the law that applies to it, and there is no single uniform rule that fits all types of information.

Is keeping data beyond the required period legally safer?

No. Keeping information beyond what is required is a legal exposure in its own right, even when there has been no report or failure at all. Information kept without a clear legal justification is a burden and a risk in itself; keeping it for too short a time is not the only risk.

Can a person demand the deletion of their personal data?

Partly. Section 14 of the Protection of Privacy Law allows a person who inspected the information about them and found that it is not correct, complete, clear or up to date to ask the database controller to correct or delete it, and if the controller refuses, it must notify the applicant of this within 30 days from the day the request was received (section 14(c) of the Law and regulation 7(b) of the Protection of Privacy Regulations (Conditions for Inspection of Information and Procedure for Appeal against a Refusal of a Request for Inspection), 5741-1981). A general right to “be forgotten” (deletion of correct information) is not set in Israeli law, and in any case a legal retention duty, such as a retention duty for tax purposes, overrides the request.