Monetary sanction under Amendment 13 to the Protection of Privacy Law: how much, how it is calculated and what to do

Service page: Digital commerce and AI lawyer: terms, privacy and direct mailing.

How much is the sanction under Amendment 13 in 2026?

The amounts written in section 23Z of the Protection of Privacy Law are base amounts, and they are updated on 1 January each year according to the Consumer Price Index, rounded to the nearest multiple of NIS 10; for per-person amounts, according to the notice, the final sanction amount after the multiplication is rounded. The notice on the amounts for 2026 was published in Yalkut HaPirsumim (the official notices gazette) on 7 October 2026, and it provides that the updated amounts apply from 1 January 2026. The sanction is calculated according to the amount in force on the day the payment demand is delivered, and if you did not present arguments within the 45 days, on the day the notice of intent to impose a sanction was delivered. So anyone who reads “NIS 150,000” today is reading the base amount; the amount for 2026 is NIS 153,540.

Most sanctions are of three types: a fixed amount, an amount per person (according to the number of people who were approached or whose information is in the database, with a floor), and an amount according to the security level of the database, for breaches of the data security regulations.

Table of amounts: what the Law says and what applies from 1 January 2026

A “floor” means that if the amount calculated by the number of people is lower than the floor, the head of the Authority may impose the floor amount (section 23Z(c)(2), (d)(3) and (e)(2)). In a per-person multiplication, the rounding is done on the final amount after the multiplication. According to the Authority’s guide, approaching people through a link on a website is an example of approaching “an indeterminate group”.

Sanction by the number of people: two calculation examples

Hypothetical example 1, an online store. The registration form on the website does not have the notice that section 11 requires, and the database holds information on 12,000 customers, with no sensitive information. The calculation under section 23Z(d) and the 2026 amounts: 12,000 × NIS 2.05 = NIS 24,600, which is above the floor of NIS 20,470. If no sanction was imposed on the store for the same provision in the five years before the violation, the head of the Authority will reduce the sanction by 20%; if the store took steps to prevent a recurrence to the head’s satisfaction, it can be reduced by another 20%, cumulatively. After both reductions: NIS 24,600 × 60% = NIS 14,760.

Hypothetical example 2, a data broker without an officer. A company whose main purpose is selling lists, with 30,000 people in its database, did not appoint a privacy protection officer. Under section 23Z(d)(1)(c): 30,000 × NIS 2.05 = NIS 61,500. If no sanction was imposed on the company for the same provision in the five years before the violation, the head of the Authority will reduce the sanction by 20%, to NIS 49,200. If the company is a “micro business” (turnover of up to NIS 4 million in the year before the violation) and it asks for this, the sanction will not exceed NIS 51,180, whether or not it was reduced; in this example the amount after the reduction is already below the cap. In addition, such a database must be registered, and processing in it without registration is a separate violation under section 23Z(a).

Breaches of the data security regulations: by security level

For a breach of the Protection of Privacy Regulations (Data Security), 5777-2017, the amount depends on the security level of the database, as defined in the Third Schedule to the Law: a database managed by an individual, or a basic, medium or high level. A high-level database that holds information on one million people or more: double the amount in the high column. Some examples, in 2026 amounts:

The amounts in the table are for 2026. “—” means that no sanction is set in the Schedule for this column. What to do when an incident happens: a data leak at a company: the duty to report to the Authority.

Reductions: conduct, micro and small businesses, and 5% of turnover

The head of the Authority may not impose an amount lower than the one set, except under the Fifth Schedule to the Law. The reductions:

• 20% if, in the five years before the violation, no sanction or administrative enforcement measure was imposed for a breach of the same provision; 10% if none was imposed in the three years before the violation, even though one was imposed within the five years.
• 30% if you stopped the violation on your own initiative and reported it to the head of the Authority.
• 20% if you took steps to prevent a recurrence and to reduce the damage, to the satisfaction of the head of the Authority.
• 10% for a body that must appoint a privacy protection officer only because of systematic monitoring or sensitive information, and appointed one before the notice of intent to impose a sanction.
• Up to 30% because of compensation paid or awarded for the same violations; 20% for an individual, in personal circumstances.
• The head of the Authority may combine the reductions, up to 70% at most.

Caps for a micro business and a small business. A “micro business” is one whose turnover in the year before the violation did not exceed NIS 4 million; a “small business”, above NIS 4 million and up to NIS 10 million. At their request, the sanction will not exceed these caps, in 2026 amounts:

When there are several violations, a micro or small business will not pay more than the highest cap among them. Another reduction: if the sanction, after all the reductions, exceeds 5% of the turnover, the head of the Authority will reduce it to 5% of the turnover, at your request. The request for the cap or for the 5% is filed with a confirmation of the turnover, within 30 days of the date the notice of intent to impose a sanction was delivered. The confirmation is given by the auditor (the auditing CPA), and if there is no duty to appoint one, by a CPA or a tax advisor who represents the business, and it confirms that the turnover matches what was reported to the Israel Tax Authority or to the National Insurance Institute (Bituach Leumi).

You received a notice of intent to impose a sanction: 45 days

Every sanction starts with a written notice of intent to impose a sanction, which sets out the violation, the amount and the right to present arguments. You have 45 days to argue against the charge itself and against the amount, in writing or orally, as the head of the Authority decides, and the head may extend the deadline for special reasons. If you did not present arguments within that period, the notice is treated as a payment demand. After the arguments, the head of the Authority decides whether to impose a sanction and in what amount, and gives reasons for the decision.

What to check within the 45 days: whether the provision that was breached applies to you at all; whether the number of people in the calculation is correct; which security level the database belongs to; which reductions you are entitled to; and whether you are a micro or small business, in which case the confirmation of turnover must arrive within 30 days.

An administrative warning instead of a sanction

In the circumstances set in the Protection of Privacy Regulations (Administrative Warning), 5786-2026 (תקנות הגנת הפרטיות (התראה מינהלית), התשפ״ו-2026), the head of the Authority may give a warning instead of imposing a sanction. For example, for a first breach of some of the data security duties, such as a database definitions document in a database managed by an individual or at the basic level, securing the internet connection, and documentation duties. You can ask for a warning to be canceled within 45 days; continuing the violation after the warning counts as a continuing violation. A warning is an option for the Authority, not a right of the violator.

Continuing violation, repeat violation, publication, payment and appeal

• Continuing violation: a person who continues the violation after receiving a payment demand has one hundredth of the sanction added for each day.
• Repeat violation: a breach of the same provision within two years of a previous breach for which a sanction was imposed adds an amount equal to the sanction.
• Publication: the Authority publishes every sanction on its website: the nature of the violation, the amount, the reductions and the name of the corporation; the publication stays up for four years for a corporation and two years for an individual. The name of a corporation will not be published when the violation is minor, unless publication is needed to warn the people whose information is in the database.
• Payment: within 45 days of the payment demand; late payment adds interest and late-payment charges.
• Appeal: to the Magistrates’ Court where the President of the Magistrates’ Court sits, within 45 days of the notice; the appeal does not delay payment unless the head of the Authority agreed or the court ordered otherwise.

Frequently asked questions

What is the fine for not registering a database?

In 2026, NIS 153,540 for processing information in a database that must be registered and was not, and double the amount if the database holds information on one million people or more (section 23Z(a); the notice of 7 October 2026). Since Amendment 13, the registration duty itself applies only to data brokers with more than 10,000 people and to databases of government ministries, local authorities and other bodies that perform public functions under law.

Why do many places say NIS 150,000?

That is the base amount in the Law. The amounts are updated on 1 January according to the CPI, and the notice on the 2026 amounts was published only on 7 October 2026, with effect from 1 January 2026.

Can the sanction be reduced?

Yes, only under the Fifth Schedule: 20% or 10% when there were no previous violations, 30% for stopping the violation and reporting it on your own initiative, 20% for preventive steps, and more; cumulatively up to 70%, at the discretion of the head of the Authority. In addition, there are caps for a micro business and a small business, and a reduction to 5% of the turnover.

How long do you have to respond to a notice of intent to impose a sanction?

45 days, and the head of the Authority may extend this for special reasons. A confirmation of turnover, to request the cap or the reduction to 5%, is filed within 30 days of the date the notice was delivered.

How do you appeal a monetary sanction of the Privacy Protection Authority?

By an appeal to the Magistrates’ Court where the President of the Magistrates’ Court sits, within 45 days of the notice of the decision. The appeal does not delay payment, unless the head of the Authority agrees or the court orders otherwise.

Will the sanction be published?

Yes. The Authority publishes on its website the violation, the amount and the reductions, and the name of the corporation, for four years (two years for an individual). For a minor violation, the name of the corporation is not published, unless publication is needed to warn the people in the database.

Will the amounts change in 2027?

They are updated on 1 January each year according to the rate of change in the CPI, and the Authority publishes a notice in Reshumot and on its website. The amounts on this page are for 2026.