Privacy protection officer (DPO): who must appoint one, and what the officer does

Service page: Digital commerce and AI lawyer: terms, privacy and direct mailing.

Who must appoint a privacy protection officer (DPO)?

Since 14 August 2025, section 17B1 of the Protection of Privacy Law has required four groups to appoint a privacy protection officer. The first two are clearly defined. One is a public authority. The other is a controller of a database whose main purpose is passing information to others, with more than 10,000 people. The last two depend on “main activity” and “significant scale”, so that is where most of the doubtful questions fall.

The law defines “information of special sensitivity” by a closed list. It includes information on health, genetic information, a biometric identifier, criminal record, sexual orientation, and opinions and beliefs. It also includes location and traffic data (under the conditions in the law), and salary and financial activity data. According to the Authority’s position, “main activity” means processing that is a central component of the organization’s main purposes. So processing sensitive information only for the purpose of employing staff does not require an appointment under paragraph (4). Even then, the other provisions of the law apply to this information. One example is the notice to the Authority about a large database with sensitive information.

“Significant scale”: why there is no number, and how to check

The law does not set a number. It lists considerations (section 17B1(b)). They are the number of people whose information is processed, and their proportion within a particular population. They include the extent of the information, its quantity and the variety of its types. And they include the duration and frequency of the processing, the retention period and the geographical area. The Authority issued an opinion (גילוי דעת) on 14 July 2026. It made clear that there is no single quantitative threshold, and that the considerations are not cumulative. There may also be further considerations. According to the Authority, a large number of people is enough on its own. Even when the number is not large, another consideration can tip the balance.

A point that surprises service providers: for a holder, the scale is assessed cumulatively, across all the databases of all its customers. The Authority gives an example. A holder processes sensitive information for 1,000 databases, each with information on only 100 people. That holder processes sensitive information on a significant scale. So a software provider for managing clinics, for example, needs to check the overall total, even when each of its customers is small.

A hypothetical example: a company operates a fitness app. It collects the location and heart rate data of 40,000 users, and this is the core of its service. The Authority lists location apps and wearable devices that track health data as examples of regular and systematic monitoring. Heart rate data is information about a person’s state of health. So it is information of special sensitivity. Location data is included in the definition only under the conditions in paragraph (9) of the definition. An example is location data that reveals a state of health or beliefs. Whether the scale is “significant” is assessed according to all the considerations, not according to the number alone. In case of doubt, the Authority notes that you can contact it with a specific question.

What the officer does, and to whom they report

The officer works so that the organization complies with the law. Section 17B2 sets out their duties. They serve as a professional authority and advise management and employees. They prepare a training program and supervise it. They prepare a monitoring program and report deficiencies to management. They make sure there is a data security procedure and a database definitions document. They make sure that requests from people whose information is in the database are handled, including requests for access and correction. And they serve as the contact person with the Authority. The ways of contacting the officer are published to the public in an accessible and simple way. The organization must give the officer the conditions and resources needed and involve them in every matter of privacy protection law. The officer reports directly to the CEO, or to an employee who reports directly to the CEO.

An external officer, conflict of interest, and the data security officer

The officer can be someone who is not an employee of the organization (section 17B3(b)). According to the Authority, only a person (an individual) can be appointed, even when the engagement is made through a company that employs them. There is no express requirement that they be an Israeli citizen or resident, but they must also be physically available in the organization as needed.

The officer may not hold an additional role, or be subordinate to an officer (office holder) of the organization, if this may put them at risk of a conflict of interest (section 17B3(c)). According to the Authority, the officer cannot hold a role that sets the purposes of the processing or decides on its means. A conflict of interest often exists for a marketing manager, an account manager, a finance manager and the chief technology officer. It usually exists for the information systems manager. The law does not prohibit combining the role of privacy protection officer with the role of data security officer or chief data security officer. But according to the Authority, it requires a specific, reasoned and documented examination.

The qualifications are set in section 17B3(a). They are in-depth knowledge of privacy protection law, an appropriate understanding of technology and data security, and familiarity with the organization’s areas of activity. According to the Authority, in-depth knowledge of Israeli law is usually acquired through significant practical experience. A course of at least 40 hours given or sponsored by the Authority is desirable. But it is not mandatory and is not enough on its own. Familiarity with the GDPR is not a substitute for knowledge of Israeli law.

Data security officer: a separate duty

Alongside the privacy protection officer there is an older duty: appointing an data security officer (section 17B). It applies to a controller or holder of five databases that require registration or notice to the Authority. It also applies to a public authority, and to a bank, an insurance company and a credit rating or credit assessment company. The two roles are different: one is responsible for data security, the other for compliance with the law as a whole.

What happens if you do not appoint one

The law set a monetary sanction for failing to appoint an officer only for two groups (section 23Z(d)(1)(c)). These are a public authority and a data broker, that is, groups 1 and 2. In 2026, the sanction is NIS 2.05 for each person whose information is in the database. It is NIS 4.09 when the information is of special sensitivity. If the total is less than NIS 20,470 (or NIS 40,940 for sensitive information), the head of the Authority may impose that amount instead. For example, take a public authority whose database holds sensitive information on 100,000 people, and which did not appoint an officer. The sanction is 100,000 × NIS 4.09 = NIS 409,000 according to the amounts for 2026. In the base amounts in the law, it is NIS 400,000, as in the Authority’s example.

For groups 3 and 4, the law did not set a direct sanction for failing to appoint. Instead, some bodies must appoint an officer only because of paragraphs (3) or (4). If such a body appointed one before receiving a notice of intent to impose a sanction, it is entitled to a 10% reduction of a sanction for another violation. The Authority announced that it intends to use its powers to make sure that the appointment meets all the requirements of the law. This includes the in-depth knowledge required. All the amounts and reductions: monetary sanction under Amendment 13: the amounts for 2026.

Frequently asked questions

Must a small business appoint a privacy protection officer (DPO)?

The size of the business is not the test. A business must appoint one in three cases (section 17B1). It is a public authority, or a data broker with more than 10,000 people. Or its main activity involves systematic monitoring of people or processing of sensitive information on a significant scale. Take a shop or an office that keeps a customer list for its work. It has no systematic monitoring and does not process sensitive information as a main activity. It does not fall within these groups just because of the list.

Can an external officer be appointed?

Yes. The officer can be someone who is not an employee of the organization (section 17B3(b)). According to the Authority, they must be a specific person, even if the engagement is through a company, and physically available as needed.

Can the data security officer also be the privacy protection officer (DPO)?

The law does not expressly prohibit this. According to the Authority, combining the roles requires a specific and documented examination. One reason is that a data security officer does not necessarily have in-depth knowledge of privacy law. Another is that the privacy protection officer must report directly to the CEO.

What is the fine for not appointing an officer?

A monetary sanction was set only for a public authority and a data broker. In 2026, it is NIS 2.05 for each person in the database (NIS 4.09 for sensitive information). If the total is less than NIS 20,470 (NIS 40,940 for sensitive information), the head of the Authority may impose that amount instead. Some bodies must appoint an officer because of monitoring or sensitive information. For them, no direct sanction for failing to appoint was set. An appointment entitles them to a 10% reduction of other sanctions.

Does the officer have to take a course?

The law requires in-depth knowledge of privacy protection law, an understanding of technology and data security, and familiarity with the organization. According to the Authority, a course of at least 40 hours given or sponsored by it is desirable. But it is not mandatory, and it is not enough without further experience or education.

We are a cloud software provider that processes data for customers. Do we also have to?

Possibly. A provider that processes information for others is a “holder”, and the duty under paragraphs (3) and (4) also applies to a holder. According to the Authority, the scale for a holder is assessed cumulatively across all the databases of all its customers. A provider that processes information for a public authority must appoint an officer under paragraph (1).

From when is the duty in force?

From 14 August 2025, together with all the provisions of Amendment 13. The Authority’s final opinion on the appointment was published on 14 July 2026.