Protection of Privacy Law: the sections this site discusses

For a business that collects personal information, the first practical effect of the Law is website terms and privacy policies that describe the collection and use of the information as they actually happen.

What the law provides

Section 1 of the Law sets a basic prohibition: “No person shall invade the privacy of another without their consent.” Section 2 sets out a list of 12 forms in which such an invasion occurs. They include, for example, spying on or trailing a person, eavesdropping that is prohibited by law, photographing a person while they are in a private domain, publishing a photograph of them in circumstances in which the publication may humiliate or degrade them, using their name, image or voice for profit without their consent, breaching a duty of confidentiality set by law regarding their private affairs, and publishing a matter that concerns a person’s intimate private life.

An invasion of privacy committed willfully, and not only negligently, is also a criminal offense under section 5, punishable by up to five years’ imprisonment, in addition to the possible civil liability (section 4). The offense in section 5 applies to most of the forms in section 2, but not to paragraph (2) (eavesdropping prohibited by law) and not to paragraph (8) (breach of a duty of confidentiality set by agreement). When a body collects personal information from a person, section 11 imposes a duty of disclosure on it: to tell the person giving the information whether there is a legal duty to give it or whether giving it depends on their will and consent, for what purpose the information is requested, and to whom it will be passed. Since Amendment No. 13 (in force from 14 August 2025), it must also give the name of the controller of the database and how to contact them, and the existence of the rights of access and correction. Section 13 gives every person a right of access to the personal information held about them in a database, and section 14 allows them to ask to correct or delete information that is not correct, complete, clear or up to date.

Section 17D provides that personal information in a database used for direct mailing services may not be processed unless the database is registered in the Register and one of its registered purposes is direct mailing services. Section 17F requires every direct mailing approach to state that it is direct mailing, the registration number of the database, the right to be removed from it, and the identity of the controller of the database and the sources from which it received the information. It gives every person a right to demand in writing that the information about them be deleted from the direct mailing database, and places a duty on the controller to act accordingly and to give notice of this in writing.

A numerical example

A marketing company collects a list of 5,000 customers from a CRM database and sends them advertising messages without being open about the source of the information. A customer who receives such an approach may, under section 17F, demand in writing that their details be deleted from the company’s direct mailing database, and the company must act accordingly and stop contacting them. If the same company also published by mistake, in public, the list of the names of the 5,000 customers with their phone numbers, this may be an invasion of privacy under section 2(9) (passing on information about a person’s private affairs other than for the purpose for which it was given) with regard to each of them, and where the invasion is willful it may also give rise to criminal liability under section 5.

For practical guides on compensation for invasion of privacy and on direct mailing, see Compensation for invasion of privacy: claims and case law and Direct mailing and advertising: two laws, two duties, as well as the page Digital commerce, AI and privacy.

The sections the site discusses

This page brings together 7 sections of the Protection of Privacy Law that are discussed in 6 guides on this site. The title of each section is the marginal note of the consolidated version of the Law (unofficial translation), not a heading we wrote. The last column links to the guides on this site that discuss that section.

The original text of the law

• Protection of Privacy Law, 5741-1981: text of the Law
• Protection of Privacy Law (Amendment No. 13), 5784-2024 — Sefer HaHukim 3287 (Knesset, PDF, in Hebrew)
• Protection of Privacy Law: consolidated version on Nevo (Israeli legal database)

FAQ

What counts as invasion of privacy under the law?
The Law lists 12 forms, including spying, eavesdropping, photographing a person in a private place, publishing a degrading photograph, using a name or image for profit without consent, and breaching a duty of confidentiality regarding private matters (section 2).

Is invasion of privacy a criminal offense?
When the invasion is committed willfully, yes. For most of the forms in section 2 (but not paragraph (2), eavesdropping, and not paragraph (8), breach of confidentiality set by agreement), the penalty set by law is up to five years’ imprisonment (section 5), in addition to possible civil liability.

Can you demand that your details be deleted from a direct mailing database?
Yes. Section 17F entitles every person to demand in writing the deletion of the information about them from a database used for direct mailing, and the database owner must act accordingly and notify them in writing that it has done so. If it did not give notice within 30 days of receiving the demand, you can apply to the Magistrates’ Court for an order that it do so (section 17F(d)–(e)).

Can you inspect the information collected about you in a database?
Yes. Section 13 entitles every person to inspect the personal information held about them in a database, and section 14 allows them to ask to correct or delete information that is not correct, complete, clear or up to date.

Can you get compensation for invasion of privacy without proving damage?
Yes. Invasion of privacy is a civil wrong (section 4), and in a claim for it the court may award compensation of up to NIS 50,000 without proof of damage, and up to double that amount if it was proved that the invasion was committed with intent to harm (section 29A(b)). The amounts are linked to the consumer price index and updated every month (section 29A(d)), and such compensation is given only once for the same invasion (section 29A(c)). The actual amount is at the court’s discretion and depends on the circumstances.

This page collects the references to legislation on the site. The section headings are the marginal notes as worded in the consolidated text of the law, and are not our interpretation. The binding text is the one published in Sefer HaHukim (the official gazette of statutes). The content here is general information and is not legal advice. Translated: 12 November 2026 · Hebrew version updated: 13 October 2026.