Data protection & privacy laws in Palestine (2026)

Palestine has not enacted a comprehensive data-protection law. UNCTAD classifies it among the small minority of countries that have only draft legislation, none of which has been adopted.

A drafting committee was assigned in 2016; the latest reviewed version is the third reading dated 15 June 2022, which has been referred repeatedly back to ministries and never issued.

Article 32 of the 2003 Amended Basic Law prohibits arbitrary or unlawful interference with a person's privacy, family, home or correspondence; Palestine has also acceded to the ICCPR (Article 17).

The Cybercrime Law by Decree No. 10 of 2018 contains limited privacy-relevant provisions (e.g., court-authorized interception of communications, capped at three months) but is widely criticized for enabling surveillance rather than protecting personal data.

There is no operational independent data-protection authority. 7amleh's 2023 analysis warns that the draft decree's proposed oversight board lacks defined qualifications and independence guarantees.

The draft decree is modeled on international standards, incorporating principles such as lawfulness, fairness, transparency and rules on collection, processing and storage of personal data — but these take effect only if and when the law is issued.