Israel’s privacy law changed fundamentally on 14 August 2025. Amendment 13 aligned key definitions with the GDPR, gave the Privacy Protection Authority (PPA) power to impose significant administrative fines and introduced mandatory DPOs for many organisations.
Israel also has strict Data Security Regulations that grade databases by security level, and Israel holds EU adequacy, making it a common base for global tech companies.
- Core data law
- Protection of Privacy Law 1981, as amended (Amendment 13)
- In force
- 14 Aug 2025
- Regulator
- Privacy Protection Authority (PPA)
- Security
- Data Security Regulations 2017
- DPO
- Mandatory for specified organisations
- Penalties
- Administrative fines into the hundreds of thousands of NIS per violation; damages without proof of harm
Who needs to comply
Israeli startups and companies processing data in Israel
The law applies to databases and processing in Israel.
Data brokers and companies monitoring people at scale
Amendment 13 requires DPOs and adds stricter duties.
The laws, in detail
01Protection of Privacy Law (Amendment 13)
Definitions aligned with GDPR concepts, database duties, DPOs, transparency and enforcement.
When it applies
Owners and holders of databases in Israel.
What you must do
- Transparent notice at collection
- Appoint a DPO where required
- Limit database registration to specified cases
- Respect access and correction rights
Regulator
Privacy Protection Authority
Penalties
Administrative fines without a court, statutory damages up to NIS 10,000 per violation without proof of harm, and criminal sanctions.
02Data Security Regulations
Security levels, access controls, documentation, audits and incident reporting.
When it applies
Database owners and holders.
What you must do
- Classify databases by security level
- Security procedures and periodic risk assessments
- Report severe security incidents to the PPA
Regulator
Privacy Protection Authority
Penalties
Enforced through the Privacy Protection Law.
03Communications Law, Section 30A (anti-spam)
Advertising by email, SMS, fax and automated calls.
When it applies
Sending marketing messages to recipients in Israel.
What you must do
- Prior explicit consent
- Mark messages as advertising
- Easy refusal mechanism
Regulator
Courts (class actions common)
Penalties
Statutory damages up to NIS 1,000 per message without proof of harm.
04AI policy (principles-based)
Israel’s non-binding AI regulation and ethics policy, applied through sector regulators.
When it applies
AI developers and deployers in Israel.
What you must do
- Follow sector regulator guidance
- Risk-based approach to AI in regulated sectors
Regulator
Ministry of Innovation, Science and Technology; sector regulators
Penalties
None directly.
05Israel Securities Authority & capital markets rules for crypto
Licensing of trading platforms and crypto-related services.
When it applies
Crypto trading platforms and financial asset service providers in Israel.
What you must do
- Licensing under capital markets and financial services laws
- AML/CFT compliance
Regulator
Israel Securities Authority; Capital Market Authority
Penalties
Licence action and penalties.
Compliance checklist
01 · Before you launch
- Classify databases under the Data Security Regulations
- Notice at collection in Hebrew where relevant
02 · At launch
- Appoint a DPO if required
- Security procedures document
- Incident reporting process
03 · As you scale
- Periodic risk surveys and penetration tests at higher security levels
- Review of data broker or monitoring activities
Key dates
- May 2017Data Security Regulations in force
- 14 Aug 2025Amendment 13 in force
- Oct 2025PPA DPO enforcement begins
Common mistakes
- Treating Israeli security regulations as optional
- No DPO when processing sensitive data at scale
FAQs
Does the EU recognise Israel as adequate?
Yes, Israel has an EU adequacy decision, reaffirmed in 2024.
Sources
Reviewed 12 October 2026. General information, simplified for planning; not legal advice. Check current law before relying on any requirement, and get advice for your facts. For markets outside India, advice is coordinated with locally qualified counsel.