Data & Privacy · Israel
Data protection & privacy law in Israel (2026)
Israel shaded by its data & privacy status
Data protection in Israel: comprehensive law.
FrameworkProtection of Privacy Law, 5741-1981 (PPL), as substantially modernized by Amendment 13 (in force 14 August 2025); supervised by the Privacy Protection Authority (PPA) within the Ministry of Justice.
Israel has a comprehensive, GDPR-adjacent data protection regime anchored in the 1981 Protection of Privacy Law and the Protection of Privacy Regulations (Data Security) 2017. Amendment 13, which took effect on 14 August 2025, redefined core concepts (personal data, controller/processor), introduced mandatory DPOs, overhauled registration, and gave the PPA direct administrative-fine powers that it has started using in 2026. Israel also retains an EU adequacy decision, reaffirmed by the European Commission on 15 January 2024.
Key points
The Protection of Privacy Law, 1981 governs processing of personal data in databases, supplemented by the Data Security Regulations 2017. The Privacy Protection Authority (PPA) at the Ministry of Justice is the supervisory authority.
Amendment 13 (effective 14 August 2025) is the biggest reform in decades: it aligns definitions with GDPR concepts, narrows and modernizes database registration, mandates DPO appointment for certain controllers/processors, and empowers the PPA to impose administrative monetary penalties without court proceedings.
The PPA now wields administrative fines ranging up to millions of shekels. In July 2026 it issued its first breach-notification fine of NIS 256,000 against the Meuhedet health fund; a separate NIS 12,000 fine was imposed on A.D Karting for notice failures.
Controllers must obtain informed consent, provide transparency notices (purpose, recipients, consequences of refusal, rights of access/rectification), implement the Data Security Regulations' tiered security measures, notify severe security incidents to the PPA, and — where thresholds apply (e.g., sensitive data on >100,000 subjects, systematic monitoring, or processing as core activity) — appoint a DPO with independence and reporting lines.
Individuals have statutory rights of access (in Hebrew, English or Arabic), rectification and deletion of inaccurate/outdated data, and the right to object to use for direct-mail marketing. Amendment 13 did not introduce a general GDPR-style right to portability or erasure, but strengthened transparency and notice duties.
The European Commission reaffirmed Israel's adequacy for personal-data transfers from the EEA on 15 January 2024, allowing data to flow without additional safeguards; the decision will be reviewed every four years and remains the subject of civil-society challenges.
Timeline - major decisions & events
The most sweeping reform of Israeli privacy law in decades takes effect, broadening 'personal' and 'sensitive' data definitions (IP addresses, geolocation, biometrics), mandating data protection officers, and converting the regulator into a full enforcement agency aligned with the GDPR.
Library of Congress (Global Legal Monitor) ↗Shortly after the reform took effect, the Privacy Protection Authority used its new powers to fine an offender NIS 75,000 for repeated violations, signaling a shift to active, penalty-based enforcement.
AI-Law ↗Following a 2020 data breach of the PayBox app, the Tel Aviv District Court approved a class-action settlement under which the bank pays NIS 3.02 million; the PPA had found security deficiencies in violation of the Privacy Protection Law.
ICLG ↗Israel's parliament passed the comprehensive privacy overhaul, introducing tiered turnover-based monetary sanctions and substantially enlarged enforcement powers for the regulator, with a one-year run-up to entry into force.
IAPP ↗Following the GDPR-mandated four-year review, the Commission reaffirmed Israel as providing an adequate level of protection, preserving seamless EU-to-Israel personal-data transfers despite civil-society objections.
European Commission ↗The Knesset approved detailed data-security rules classifying databases into four risk tiers with mandatory access controls, audits, and breach-notification duties; they entered into force in May 2018 alongside the GDPR.
IAPP ↗A Knesset amendment ended the voluntary phase of the biometric program, requiring fingerprint/facial data on Israeli ID cards and passports, with data held in a secured, offline national biometric database separate from the Population Registry.
National Biometric Database Authority ↗Under Directive 95/46/EC the Commission recognized Israel as offering adequate protection for automated processing of personal data, enabling EU data transfers; the decision excludes territories administered since 5 June 1967.
EUR-Lex (European Commission) ↗The Knesset authorized collection of fingerprints and facial contours from all residents into a central biometric database for ID cards and passports, establishing the legal basis for Israel's biometric identity infrastructure.
Library of Congress (Global Legal Monitor) ↗Pursuant to Government Decision No. 4660, the Israeli Law, Information and Technology Authority was created in the Ministry of Justice to enforce privacy law and oversee databases; it was later renamed the Privacy Protection Authority.
IAPP ↗The Knesset gave privacy constitutional status, declaring every person's right to privacy and to the confidentiality of their conversations, writings, and records, anchoring later data-protection jurisprudence.
Knesset ↗Israel passed one of the world's earliest comprehensive privacy statutes, creating database registration duties, civil and criminal liability for privacy infringement, and the foundation of the modern framework.
WIPO Lex ↗Israel - other topics
Data & Privacy in other countries
Last verified 10/3/2026 · Orientation, not legal advice - verify against the primary sources linked above. Methodology & how to cite · State of Technology Regulation 2026 · Explore the full world map →