Amendment No. 13 to the Protection of Privacy Law: what a business must do now

What changed on 14 August 2025

Service page: Digital commerce and AI lawyer: terms, privacy and direct mailing.

Amendment No. 13 to the Protection of Privacy Law, 5741-1981 was published on 14 August 2024. It provided that it would come into force one year from its publication, that is, on 14 August 2025. It is the most significant change in Israel’s data protection law in decades, and it concerns every business that keeps a customer list.

There are three main shifts. First, the definitions in the Law were updated (“personal information”, “information of special sensitivity”, “controller”, “holder”). Second, the registration duty was cut back dramatically and replaced by a notice duty. Third, the enforcement powers of the Privacy Protection Authority were extended to monetary sanctions in significant amounts. New criminal offenses and wider compensation without proof of damage came with them.

The duties the questionnaire checks, in one table:

Some collections are not a “database” under the Law. This applies to a collection that contains only names, addresses and contact details, of up to 100,000 people. It must not in itself reveal further information, and no other collection about the same people may accompany it. What does a “significant scale” mean for a privacy protection officer, and why does it have no number? The guide Privacy protection officer: who must appoint one explains this.

Registering a database: who still has to, and how much it costs

Until the amendment, the registration duty applied to almost every database in the economy. Today, under section 8A(a), a database must be registered only in one of two cases:

• its main purpose is collecting personal information in order to give it to another as a business or for payment (including direct mailing services). And it contains personal information about more than 10,000 people;
• the controller of the database is a public body as defined in paragraph (1) of the definition in section 23 of the Law. This does not apply if the database contains information about that body’s employees only.

In practice, many businesses manage a customer database for their own activity: an online store, an office, a clinic or a service company. Such a business no longer has to register it. The head of the Authority may even exempt a database that must be registered. The condition is that the head is satisfied that registration is not needed to ensure compliance with the Law.

There is no registration fee. Section 36A of the Law authorizes the Minister of Justice to set fees only for inspecting databases. Its two other subsections were repealed. What a business must do is meet the duties themselves. These are a database definitions document, a security procedure and an agreement with providers that process the information. In an online business, all of these end up as two documents that the user sees: website terms and privacy policy. So write them after the mapping, not before it.

Take a database that was registered in the past and no longer has to be registered. The head of the Authority will delete it from the Registry if the controller gave notice that the database no longer has to be registered. The controller must verify the notice by an affidavit. Deletion from the Registry does not release you from the other duties. One of them is the notice to the Authority when the database contains information of special sensitivity about more than 100,000 people.

The new notice duty: large databases with sensitive information

Instead of general registration, section 8A(b) sets a targeted duty. It applies to a database that does not have to be registered. If the number of people about whom it holds information of special sensitivity exceeds 100,000, the controller must notify the Authority within 30 days. The notice includes the identity of the controller, its address and contact details. It includes the identity and contact details of the privacy protection officer, if one must be appointed. And it includes a copy of the database definitions document required under the Protection of Privacy Regulations (Data Security), 5777-2017. Any change in these details, and the end of the database’s activity, are also reported within 30 days.

The Law defines “information of special sensitivity” in a closed but broad list. It covers the privacy of family life, intimate life and sexual orientation; health condition; genetic information; and a biometric identifier used for identification. It also covers origin; criminal record; political opinions, religious beliefs and worldview; and a professional personality assessment. Finally, it covers location and traffic data; salary and financial activity data; and information subject to a duty of confidentiality under law.

Do you have a “database” at all?

The definition itself has changed. A “database” is a collection of personal information items processed by digital means. There are two exceptions. One is a collection for personal use that is not for business purposes. The other is a collection that includes only names, addresses and contact details, of 100,000 people or fewer, which does not in itself reveal further information. This exception applies only if the owner of the collection, or a corporation it controls, has no other collection with other details about the same people.

So a clean mailing list of a thousand recipients may not be considered a database. But once purchase history, browsing data or customer segmentation is added to it, it is a database in every respect. On an e-commerce site, this is almost always the case.

Privacy policy: what it must include

The hard core of the privacy policy is in section 11 of the Law. Every request to a person for personal information in order to process it in a database must come with a notice. The notice states whether there is a legal duty to give the information, or whether giving it depends on the person’s will and consent. It states what the consequence of not consenting is, and the purpose for which the information is requested. It gives the name of the controller of the database and its contact details. It says to whom the information will be given and the purposes of giving it. And it mentions the right of access under section 13 and the right to request correction under section 14.

A useful policy is built around this core. It covers which types of information are actually collected (including browsing data and online identifiers) and the basis for processing. It also covers providers and sub-processors, transfer outside Israel, retention periods and security measures. Two practical warnings. A policy that contradicts your practice is worse than no policy, because it is written evidence against the database owner. And a copied template that promises things you do not do is exactly that contradiction.

What counts as consent? The Authority’s position from February 2026

On 25 February 2026, the Privacy Protection Authority published an opinion (גילוי דעת) on consent, and it will also use it when imposing monetary sanctions. In the Authority’s position, as a rule, silence or lack of objection is not, in itself, valid consent. A material change in the terms of use of information without further consent is considered use without consent. And consent for one purpose does not allow use for another purpose. When an agreement asks for consent to collect information that is not needed for the service, or to use it for a materially different purpose, the Authority recommends separate active consent and not a pre-ticked box. In some cases, in its position, passive consent is not enough. These are profiling that is not needed for the service, between parties with a power imbalance, and direct mailing services. In a form, the Authority recommends a separate box, not ticked in advance, for every use that is not needed for the service itself. For such profiling and for direct mailing services, in its position this is a requirement, not a recommendation. See also consent to cookies on a website.

Privacy protection on e-commerce sites: the specific points

An e-commerce site collects information through three channels at the same time. There is what the customer gives in a form, what is collected automatically while browsing, and what comes from third-party tools. Each has its own rules:

• Notice at the time of collection: the registration and checkout forms are the “request” that section 11 refers to. A link to the privacy policy next to the fields, and not only in the footer.
• Tracking and cookies: collecting browsing data and online identifiers is collecting personal information when it can be attributed to an identifiable person. What consent to cookies actually requires.
• Direct mailing: a personal approach based on belonging to a population group defined by a profile. The Law gives a person the right to demand that information about them be deleted from a database used for direct mailing. They may also demand that it not be given to others. Not complying with such a demand is a breach that carries a monetary sanction. The direct mailing rules in detail.
• Providers: every provider that processes information for you is a “holder”. Engaging it requires a detailed agreement under regulation 15 of the Data Security Regulations. What such an agreement must include.
• Retention and deletion: retention periods set in advance are both a legal protection and a way to limit the damage in a security incident.

Privacy protection officer: who must appoint one

Section 17B1 requires the appointment of a privacy protection officer in four groups. The first is a public body (and also anyone who processes information for it). The second is a controller of a database whose main purpose is giving information to others, with more than 10,000 people. The third is anyone whose main activities involve regular and systematic monitoring of people on a significant scale. The fourth is anyone whose main activity includes processing information of special sensitivity on a significant scale, such as a bank, an insurer, a hospital and a health fund. According to the Authority’s opinion of 14 July 2026, a “significant scale” has no numerical threshold. It is assessed by the number of people, the scope of the information, its types, the duration of the processing and other considerations. The officer reports directly to the general manager, or to someone who reports directly to the general manager. The officer may also be someone who is not an employee of the body. A separate duty is appointing a data security officer under section 17B. The details, including an external officer and conflict of interest: Privacy protection officer: who must appoint one.

Duties and deadlines after Amendment 13: a summary table

A hypothetical example: on 1 October 2026, an online store holds a database of 12,000 customers. It holds name, delivery address, phone, email and interests that the customers ticked, without information of special sensitivity. It uses the database only to manage orders and to contact its customers. The database does not have to be registered, because its main purpose is not giving information to another (section 8A(a)). There is also no duty to notify the Authority (section 8A(b)). The store is still subject to the notice on every form (section 11) and the duties of the Data Security Regulations. It also needs an agreement with the delivery company that receives access to the addresses (regulation 15). If selling the customer list to others becomes the main purpose of the database, it will have to be registered, and a privacy protection officer will have to be appointed (sections 8A(a)(1)(a) and 17B1(a)(2)).

What to keep

• The wording of the section 11 notice shown on each form, and from what date it has been used.
• The database definitions document and the record of its annual review (regulation 2).
• The security procedure (regulation 4).
• The record of every security incident (regulation 11(a)).
• The agreements with providers that receive access to the database (regulation 15).
• Requests for access and correction, and when and how they were answered (sections 13–14).

Data security: what the law actually requires

The Protection of Privacy Regulations (Data Security), 5777-2017 sort databases into security levels and set duties for each level. The levels are basic, medium and high, plus a lighter track for a database managed by an individual. The common core is the database definitions document (regulation 2), a security procedure (regulation 4), and mapping of systems and a risk survey (regulation 5). It also includes management of access permissions, identification and authentication, and monitoring and logging of access. Finally, it includes secure management of systems, communications security, periodic audits and backup.

Regulation 11 requires a record of every incident that raises a concern of harm to the integrity of the information or of unauthorized use. In a severe security incident, it requires immediate notice to the Authority and a report on the steps taken. The Authority may also order notice to the data subjects who may be harmed. There is a direct link between the requirements of the regulations and the privacy policy document. What you have declared externally must be backed by an internal procedure.

Enforcement: the monetary sanctions for 2026, compensation and claims

The amounts in the Law are base amounts, and they are updated on 1 January every year according to the consumer price index. The notice of the amounts for 2026 was published in Reshumot (the official gazette) on 7 October 2026. The amounts in it apply from 1 January 2026. Take the monetary sanction for processing information in a database that must be registered but was not. The same sanction applies to not giving the notice under section 8A(b). It is NIS 153,540 in 2026 (in the Law: NIS 150,000). It is double that amount if the database holds information about one million people or more. Another sanction is calculated according to the number of people in the database. For processing information for a purpose that is not lawful, it is NIS 4.09 per person (NIS 8.19 for information of special sensitivity). If the calculated amount is less than NIS 204,720, the head of the Authority may impose NIS 204,720. There are caps for a micro business and a small business. Every monetary sanction starts with a notice of intent to impose it, and 45 days to argue against it. The full table and the reductions: Monetary sanction under Amendment 13: the amounts for 2026.

On the civil level, section 15A allows the court to award exemplary damages of up to NIS 10,000 for defined breaches. One is a request for personal information without the notice required by section 11 (after the person made a demand and 30 days passed). Another is not registering a database that must be registered (after a demand and 90 days). Others are not allowing the right of access, and not correcting information. In parallel, section 29A allows compensation without proof of damage for the tort of invasion of privacy. The amount stated in the Law is NIS 50,000, and section 29A(d) links it to the index. So the cap in force at the update of 16 October 2026 is NIS 72,221.22. It is double that amount, NIS 144,442.44, when it was proved that the invasion was made with intent to harm. The shortened two-year limitation period for claims under the Law was abolished. A cause of action that arose after the amendment came into force is subject to the general limitation period.

Administrative warning: when the Authority can make do with a warning

Instead of a monetary sanction, the head of the Authority may give an administrative warning in circumstances set by the Minister of Justice. The circumstances were set in the Protection of Privacy Regulations (Administrative Warning), 5786-2026 (תקנות הגנת הפרטיות (התראה מינהלית), התשפ״ו-2026), published on 16 April 2026. Among other things, it covers a breach of a provision during its first three months, if the provision came into force on or after the day the regulations came into force. It also covers a first breach of some of the data security duties. Examples are preparing and updating the database definitions document in a database managed by an individual or at a basic security level. Others are securing the internet connection, and documentation duties. A person who received a warning may ask to cancel it within 45 days. The grounds are that they did not commit the breach, or that the act is not a breach. A warning does not erase the breach: continuing the breach after it is considered a continuing breach.

FAQ

Do you still need to register a database?

In most cases, no. After Amendment 13, the registration duty applies only to two kinds of database. The first is a database whose main purpose is collecting information in order to give it to another as a business or for payment, and that contains information about more than 10,000 people. The second is a database of a public body, except for a database that contains information about its employees only.

How much does it cost to register a database?

There is no registration fee. Section 36A of the Law now authorizes setting fees only for inspecting databases. The relevant cost is the cost of meeting the substantive duties. These are a database definitions document, a security procedure, a risk survey and contractual arrangements with providers.

What must appear in the privacy policy of an e-commerce site?

At least the details in section 11. Is giving the information mandatory or voluntary, and what is the consequence of not consenting? What is the purpose of the collection? What are the name of the controller and its contact details? To whom will the information be given and for what purposes? And it must mention the rights of access and correction. Beyond that: the types of information actually collected, providers and sub-processors, transfer abroad, retention periods and security measures.

When must a privacy protection officer (DPO) be appointed?

Under section 17B1, in three cases. In a public body. For a controller of a database whose purpose is giving information to another as a business, with information about more than 10,000 people. And for a controller or holder whose main activities involve regular and systematic monitoring of people, or processing information of special sensitivity, on a significant scale.

What is the sanction for collecting data without the notice required by section 11?

In 2026, it is NIS 51.18 for each person who was approached without the notice (NIS 102.36 for information of special sensitivity). If the amount is less than NIS 30,710, the head of the Authority may impose NIS 30,710 (section 23Z(c); the notice of 7 October 2026). The request may have been made to an undefined group, for example through a link to a form on a website. Then the sanction is NIS 2.05 for each person in the database (NIS 4.09 for sensitive information). If the amount is less than NIS 20,470 (NIS 40,940 for sensitive information), the head of the Authority may impose that amount (section 23Z(d)). These are the amounts for 2026; the base amounts in the Law are updated on 1 January every year (section 23FF(b)). On the civil level, the person may have demanded to receive the notice, and 30 days passed. Then the court may award exemplary damages of up to NIS 10,000 (section 15A(a)(2)).

Our database was registered before Amendment 13 and no longer has to be registered. How do we delete it?

The controller notifies the head of the Authority that the database no longer has to be registered, and verifies the notice by an affidavit. The head of the Authority then deletes the registration (section 10(b3)). The deletion does not release you from the notice duty under section 8A(b). That duty applies if the database contains information of special sensitivity about more than 100,000 people.

What is the fine for not appointing a privacy protection officer (DPO)?

The Law set a monetary sanction for not appointing one only for a public body and a data broker (section 23Z(d)(1)(c)). In 2026, it is NIS 2.05 for each person in the database (NIS 4.09 for sensitive information). If the amount is less than NIS 20,470 (NIS 40,940 for sensitive information), the head of the Authority may impose that amount. Some bodies must appoint one because of systematic monitoring or sensitive information on a significant scale. If such a body appointed an officer before the notice of intent to impose a sanction, it is entitled to a 10% reduction of a sanction for other breaches.

Two years have passed since the invasion of privacy. Can I still sue?

It depends on when the invasion happened. Amendment 13 abolished the shortened two-year limitation period. A cause of action that arose from 14 August 2025 onward is subject to the general limitation period of seven years. According to the Authority’s guide, the abolition does not apply to a cause of action that arose before that. So an invasion from before 14 August 2025 may still be subject to the two-year period. Check the date as soon as possible.

We received an administrative warning from the Privacy Protection Authority. What does it mean?

An administrative warning is given instead of a monetary sanction, in the circumstances set in the regulations of April 2026. You can ask the head of the Authority to cancel it within 45 days. The grounds are that the breach was not committed, or that the act is not a breach. Continuing the breach after the warning is considered a continuing breach.