GDPR for an Israeli company: when it applies and what the fine is

Service page: Digital commerce and AI lawyer: terms, privacy and direct mailing.

Does the GDPR apply to you, even if the company is only in Israel?

Do you have users in Germany? Customers in France? Newsletter subscribers in Italy? The GDPR applies to a company that is not established in the EU when it offers goods or services to people who are in the EU (whether paid or free of charge) or monitors their behavior there (Article 3(2)). The test is not citizenship, and not where the company is registered, but where the people are and how the activity is connected to them. The mere accessibility of the website from Europe is not enough (Recital 23).

This is not theory. For breaching the principles of processing, the conditions for consent and the rights of data subjects, the fine is up to €20 million or 4% of total worldwide annual turnover, whichever is higher (Article 83(5)). Keeping records of processing activities (ROPA) is mandatory under Article 30, subject to an exemption for an organization employing fewer than 250 people. That exemption does not apply when the processing is not occasional, involves a risk or includes special categories of data.

The GDPR: the main points of the European regulation

The GDPR (General Data Protection Regulation) is the European Union’s privacy protection law, which has applied since 25 May 2018 (Article 99). It is one of the strictest data protection laws in the world, and it is changing the way companies all over the world handle personal data.

The main points of the GDPR:

• Legal basis for processing: companies may process data only if they have a legal basis (consent, a contract, a legal obligation and others, Article 6(1)). You cannot process data just because it is “nice” or “useful”.
• Consent: consent is only one of the six lawful bases (Article 6(1)). When you rely on it, it must be freely given, specific, informed and unambiguous, given by a statement or by a clear affirmative action (Article 4(11)). Silence or a pre-ticked box is not consent (Recital 32). “Explicit” consent is required in special cases, such as processing sensitive data (Article 9(2)(a)).
• Data subject rights: people have the right of access, rectification, erasure, restriction of processing, data portability and the right to object (Articles 15–21).
• Data protection impact assessment: when processing, especially using new technologies, is likely to result in a high risk to people’s rights and freedoms, a data protection impact assessment must be carried out before it begins (Article 35).
• Data protection officer: the duty to appoint a data protection officer (DPO) applies to a public authority, and to a body whose core activities include regular and systematic monitoring of people on a large scale, or large-scale processing of special categories of data (for example, health data) or of data on criminal convictions (Article 37(1)).
• Breach notification: notifying the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach, unless the breach is unlikely to result in a risk (Article 33). Notifying the data subjects without undue delay when the breach is likely to result in a high risk to them (Article 34).
• Fines: for breaching the principles of processing, the conditions for consent, the rights of data subjects and the rules on transfers: up to €20 million or 4% of total worldwide annual turnover, whichever is higher (Article 83(5)). For other breaches, such as the security and record-keeping duties: up to €10 million or 2% (Article 83(4)).

The GDPR is a powerful tool in favor of the right to privacy, and it has created a new standard for data protection worldwide.

Israel’s Protection of Privacy Law, 5741-1981, and the Data Security Regulations

In Israel, privacy protection is governed by the Protection of Privacy Law, 5741-1981, and related laws and regulations. It is not as strong as the GDPR, but it still places significant duties on companies.

• Protection of Privacy Law, 5741-1981: information in a database may be processed only for the purpose lawfully set for it (section 8(b)). Anyone who collects personal information in order to process it in a database must tell the person whether providing it is a legal duty or depends on their consent, what the purpose of the collection is, and to whom the information will be given. Since Amendment No. 13, the notice also includes the consequence of not consenting, the name of the controller of the database and how to contact them, and the existence of the right of access and the right to correction (section 11).
• The Data Security Regulations: the Protection of Privacy Regulations (Data Security), 5777-2017, apply to every database, at a basic, medium or high security level according to the type of information, the number of people and the number of authorized users. Anyone who holds information transferred from the European Economic Area is also subject to the 2023 regulations: duties of deletion, accuracy and informing the people concerned.
• Privacy protection officer: since Amendment No. 13 (in force from 14 August 2025), a privacy protection officer must be appointed in a public body, in a data broker whose database holds information about more than 10,000 people, and in a body whose main activity includes systematic monitoring on a significant scale or processing of information of special sensitivity on a significant scale (section 17B1). This is similar to the DPO under the GDPR.

And what is the sanction in Israel? Since Amendment No. 13, the head of the Privacy Protection Authority may impose monetary sanctions, some of which are calculated according to the number of people in the database. For example, for processing personal information for a purpose that is not lawful: NIS 4 for each person about whom there is information in the database (NIS 8 for information of special sensitivity), and if the calculated amount is less than NIS 200,000, the head of the Authority may impose NIS 200,000 (section 23Z(e)). For processing in a database that must be registered but was not: NIS 150,000, and double that amount for a database of 1,000,000 people or more (section 23Z(a)). These are the base amounts in the Law. Under section 23FF(b) they are updated on 1 January each year, and in 2026 they are NIS 4.09 (NIS 8.19), NIS 204,720 and NIS 153,540 (notice on the update of the monetary sanction amounts, Yalkut HaPirsumim 15000, 7 October 2026, in Hebrew). In addition, for certain breaches, such as refusing to allow access to information, the court may award exemplary damages (statutory damages) of up to NIS 10,000, which do not depend on proof of damage (section 15A).

When exactly must an Israeli company comply with the GDPR?

The answer is simpler than people think. The GDPR applies in three situations:

• Scope: the GDPR applies to processing in the context of the activities of an establishment of the company in the EU, regardless of where the processing takes place (Article 3(1)). It also applies to a company that is not established in the EU, when the processing relates to offering goods or services to people who are in the EU or to monitoring their behavior there (Article 3(2)).
• Targeting EU residents: offering goods or services is judged by an intention to reach people in the EU, for example the language or currency of a European country, or mentioning customers there. The accessibility of the website from Europe, or the use of Hebrew, the language generally used in Israel, is not enough on its own (Recital 23).
• Offering services/goods: if you offer services or products to people in the EU, even free of charge, the GDPR applies (Article 3(2)(a)). The same is true when you monitor their behavior there, for example by tracking and profiling on the internet (Article 3(2)(b), Recital 24).

A practical example: an Israeli startup that built an app and sells it to the European market will have to comply with the GDPR for the processing of its EU users’ data (Article 3(2)(a)), and as a rule will also have to appoint a representative in the EU (Article 27), even if most of its customers are in Israel.

7 steps to GDPR compliance: start here

Here is what you need to close, in order of priority:

• A clear privacy policy: write a privacy policy that explains in detail what data you collect, why, and how you use it.
• Consent management: check that you have clear, active consent from users. Do not use pre-ticked defaults, and do not write misleading terms.
• Data minimization: collect only the data you need for explicit purposes. Do not collect data “just because it is interesting”.
• Vendor management: if you use data processors (cloud providers, advertising platforms and the like), make sure you have a written processing agreement with them (Article 28(3)).
• Data security: take technical and organizational measures to keep data safe: encryption, restricted access, periodic monitoring.
• Breach response plan: prepare a plan for what to do if a data breach happens: what you will do, whom you will notify, and how you will do it within 72 hours.
• Regular audits: review your privacy policy periodically. How do you actually handle data? This changes from time to time.

Privacy protection is not only a legal duty. It is also a matter of trust. Companies that handle data transparently and responsibly build a stronger reputation with investors, customers and regulators, and those that neglect privacy pay the price, often more than they expected.

Frequently asked questions

Does an Israeli company subject to the GDPR need to appoint a representative in the EU?

As a rule, yes. An Israeli startup that built an app and sells it to the European market will have to comply with the GDPR for the processing of its EU users’ data (Article 3(2)(a)), and as a rule will also have to appoint a representative in the EU (Article 27), even if most of its customers are in Israel.

Does a pre-ticked box count as consent under the GDPR?

No. When you rely on consent, it must be freely given, specific, informed and unambiguous, given by a statement or by a clear affirmative action (Article 4(11)). Silence or a pre-ticked box is not consent (Recital 32). Consent is only one of the six lawful bases for processing (Article 6(1)).

When must a privacy protection officer (DPO) be appointed in Israel?

Since Amendment No. 13 (in force from 14 August 2025), a privacy protection officer must be appointed in a public body, in a data broker whose database holds information about more than 10,000 people, and in a body whose main activity includes systematic monitoring on a significant scale or processing of information of special sensitivity on a significant scale (section 17B1 of the Protection of Privacy Law).