Cybersecurity · Israel
Cybersecurity law & regulation in Israel (2026)
Israel shaded by its cybersecurity status
Cybersecurity in Israel: sectoral rules.
FrameworkNo horizontal cybersecurity statute. Obligations arise from the Regulation of Security in Public Bodies Law, 5758-1998 (critical infrastructure), the General Security Service Law, 5762-2002 (Shin Bet/ISA role), the Protection of Privacy Law, 5741-1981 and Protection of Privacy Regulations (Data Security), 5777-2017 (data breach duties), and sectoral regulator directives (notably Bank of Israel Proper Conduct of Banking Business Directives 361/364). A National Cyber Protection draft bill was published in January 2026 but is not yet enacted.
Israel does not have a single comprehensive cybersecurity law. Instead, cybersecurity obligations are imposed through a sectoral/patchwork regime — critical-infrastructure directives issued by the Israel National Cyber Directorate (INCD) and the Israel Security Agency under the 1998 Public Bodies Law, data-security and breach-notification rules under the 1981 Privacy Law and 2017 Data Security Regulations enforced by the Privacy Protection Authority, and financial-sector rules from the Bank of Israel. A horizontal National Cyber Protection Bill was released for public consultation in January 2026 but remains a draft.
Key points
The Regulation of Security in Public Bodies Law, 5758-1998 empowers the ISA (Shin Bet) and the National Cyber Directorate to issue binding information-security and cybersecurity directives to listed essential organizations (telecoms, utilities, transport, stock exchange, ccTLD registry, etc.) and to inspect their compliance.
Under the Protection of Privacy Regulations (Data Security), 5777-2017, owners of 'medium'/'high' security databases must immediately notify the Privacy Protection Authority of a severe security incident; the PPA can order notice to affected data subjects. Amendment 13 to the Privacy Law took effect on 14 August 2025, significantly expanding PPA enforcement powers.
Bank of Israel Proper Conduct of Banking Business Directive 361 (cyber defence management) was consolidated with Directives 357 and 363 into the updated framework (Directive 364), mandating board-level governance, risk management, drills, continuous monitoring, and incident reporting to the Supervisor of Banks and INCD without undue delay.
The INCD, established in 2017 and recognized by Government Resolutions and a 2019 Knesset amendment, operates CERT-IL, issues voluntary guidance (e.g., Cyber Defence Methodology for an Organisation 2.0), and coordinates national incident response, but lacks horizontal statutory enforcement powers pending the draft National Cyber Protection Law.
In January 2026 the government published a draft National Cyber Protection Law that would apply to 'essential organizations' (government, telecoms, energy, health, transport, data centres, PaaS/SaaS, cybersecurity service providers, online platforms) and impose risk-based security obligations, mandatory incident reporting, monetary sanctions and potential criminal liability. It is still in consultation and not expected to be enacted before 2027.
The General Security Service Law, 5762-2002 formally gives the Israel Security Agency responsibility for protecting designated computerized systems and critical infrastructure from cyber threats; this task has been progressively shifted toward the civilian INCD but ISA retains statutory authority for the most sensitive entities.
Timeline - major decisions & events
Israel published a draft National Cybersecurity Law creating binding obligations for 'essential organizations' (energy, health, telecom, transport) and large digital/storage service providers, with incident-reporting duties, INCD supervision, monetary sanctions up to ILS 640,000 and possible criminal liability. It is the long-awaited attempt to put the National Cyber Directorate's powers on a statutory footing after the failed 2018 bill.
Barnea Jaffa Lande ↗Amendment 13 took effect in mid-August 2025, mandating data protection officers, strengthening data-security and transparency duties and dramatically expanding the Privacy Protection Authority's enforcement powers (administrative fines scaled to number of data subjects and turnover). It aligns Israel's regime more closely with the EU GDPR.
IAPP ↗The Knesset passed Amendment 13, the most sweeping overhaul of Israeli privacy/data-security law since 1981, modernizing definitions of sensitive data and overhauling enforcement. It is the legislative backbone for organizations' data-security obligations pending a dedicated cybersecurity statute.
Israel Tech Policy Institute ↗A ransomware attack locked the Hadera hospital out of all digital systems for weeks (≈ILS 36 million in losses), becoming a landmark national incident; the INCD had earlier warned the hospital of unaddressed vulnerabilities. It triggered sector-wide INCD warnings and accelerated healthcare cybersecurity regulation.
Times of Israel ↗A legislative amendment gave statutory recognition to the National Cyber Directorate's role in protecting Israel's cyberspace, an interim step after the comprehensive 2018 cyber bill stalled. It clarified the INCD's legal standing pending a full cybersecurity law.
U.S. Library of Congress ↗The Prime Minister's Office published a draft bill to give the INCD far-reaching powers, compelling production of information, issuing binding instructions, entering premises and seizing computer material to handle cyberattacks. It drew heavy criticism over privacy and oversight and ultimately failed to advance.
Council on Foreign Relations ↗These regulations, effective alongside the EU GDPR, impose tiered data-security obligations on all database holders, access controls, encryption, audits, staff training, written security policy and breach notification to the Privacy Protection Authority within 72 hours. They remain the core operative cybersecurity/data-protection compliance rules.
Lexology ↗A government resolution unified the National Cyber Bureau and the National Cyber Security Authority into a single Israel National Cyber Directorate within the Prime Minister's Office, responsible for the full civilian cyber-defense lifecycle from policy to operational defense. This created the central regulator that shapes today's framework.
Wikipedia (Gov. Resolution) ↗Government Resolution 3611, 'Advancing National Cyberspace Capabilities,' created the Israel National Cyber Bureau in the Prime Minister's Office to set cyber policy, protect critical infrastructure and coordinate across government, academia and industry. It is the foundational document of Israel's centralized civilian cyber governance.
National Security Archive ↗Special Government Resolution B/84 assigned protection of computerized critical infrastructure to the Israel Security Agency (Shin Bet) via a new National Information Security Agency (Re'em/NISA), requiring supervised bodies to follow mandatory IT-security instructions. It was one of the world's first centralized CIP frameworks and the origin of Israel's cyber obligations.
Connections / PfP Consortium ↗Israel - other topics
Cybersecurity in other countries
Last verified 10/5/2026 · Orientation, not legal advice - verify against the primary sources linked above. Methodology & how to cite · State of Technology Regulation 2026 · Explore the full world map →