Cybersecurity regulation in Israel (2026)

Israel published a draft National Cybersecurity Law creating binding obligations for 'essential organizations' (energy, health, telecom, transport) and large digital/storage service providers, with incident-reporting duties, INCD supervision, monetary sanctions up to ILS 640,000 and possible criminal liability. It is the long-awaited attempt to put the National Cyber Directorate's powers on a statutory footing after the failed 2018 bill.

Amendment 13 took effect in mid-August 2025, mandating data protection officers, strengthening data-security and transparency duties and dramatically expanding the Privacy Protection Authority's enforcement powers (administrative fines scaled to number of data subjects and turnover). It aligns Israel's regime more closely with the EU GDPR.

The Knesset passed Amendment 13, the most sweeping overhaul of Israeli privacy/data-security law since 1981, modernizing definitions of sensitive data and overhauling enforcement. It is the legislative backbone for organizations' data-security obligations pending a dedicated cybersecurity statute.

A ransomware attack locked the Hadera hospital out of all digital systems for weeks (≈ILS 36 million in losses), becoming a landmark national incident; the INCD had earlier warned the hospital of unaddressed vulnerabilities. It triggered sector-wide INCD warnings and accelerated healthcare cybersecurity regulation.

A legislative amendment gave statutory recognition to the National Cyber Directorate's role in protecting Israel's cyberspace, an interim step after the comprehensive 2018 cyber bill stalled. It clarified the INCD's legal standing pending a full cybersecurity law.

The Prime Minister's Office published a draft bill to give the INCD far-reaching powers—compelling production of information, issuing binding instructions, entering premises and seizing computer material to handle cyberattacks. It drew heavy criticism over privacy and oversight and ultimately failed to advance.

These regulations, effective alongside the EU GDPR, impose tiered data-security obligations on all database holders—access controls, encryption, audits, staff training, written security policy and breach notification to the Privacy Protection Authority within 72 hours. They remain the core operative cybersecurity/data-protection compliance rules.

A government resolution unified the National Cyber Bureau and the National Cyber Security Authority into a single Israel National Cyber Directorate within the Prime Minister's Office, responsible for the full civilian cyber-defense lifecycle from policy to operational defense. This created the central regulator that shapes today's framework.

Government Resolution 3611, 'Advancing National Cyberspace Capabilities,' created the Israel National Cyber Bureau in the Prime Minister's Office to set cyber policy, protect critical infrastructure and coordinate across government, academia and industry. It is the foundational document of Israel's centralized civilian cyber governance.

Special Government Resolution B/84 assigned protection of computerized critical infrastructure to the Israel Security Agency (Shin Bet) via a new National Information Security Agency (Re'em/NISA), requiring supervised bodies to follow mandatory IT-security instructions. It was one of the world's first centralized CIP frameworks and the origin of Israel's cyber obligations.