Does the duty to appoint a Privacy Protection Officer apply to you
Eight questions. Three minutes. The result appears on screen.
What the assessment tests
- Whether you hold personal data on behalf of a public body
- Whether your principal purpose is collecting data for disclosure to others, with more than 10,000 individuals
- Whether your principal occupation involves regular and systematic monitoring at significant scale
- Whether your principal occupation includes processing specially sensitive data at significant scale, beyond data about your own staff
- What your cumulative exposure is across all your customers
- Whether you sell to EU customers or process EU residents’ data — a separate check under the GDPR
What the assessment is not
The result is an indication only, based on your answers and not checked against your systems, documents or contracts. It is not a determination that you do or do not comply with the law, not a legal opinion and not legal advice. Completing the assessment does not create a lawyer-client relationship.
The assessment
Question 1 of 8
This is an indicative tool. It is not legal advice.
On the answers you gave, there is a high risk that the duty to appoint a Privacy Protection Officer applies to you
If the duty applies, the Privacy Protection Law requires: appointment of an individual with deep knowledge of privacy law, adequate understanding of technology and data security, and familiarity with your fields of activity; assurance that no conflict of interest arises; direct reporting to the CEO or to someone reporting directly to the CEO; and publication of the officer’s contact details to the public accessibly and simply.
The result is an indication of risk only, based on your answers, and is not legal advice.Full text
What this result is. The result above is an indication of risk only, based solely on the answers you provided. Your systems, documents, contracts and actual position have not been examined. It is not a determination that you do or do not comply with the law, it is not a legal opinion, and it is not legal advice. It must not be relied on as a substitute for a case-specific assessment.
No lawyer-client relationship. Completing the assessment, receiving the result, or contacting the practice afterwards does not create a lawyer-client relationship. Such a relationship arises only under a written, signed engagement letter.
The law cited. The provisions referred to are from the Privacy Protection Law, 1981, as amended by Amendment 13, in force from 14 August 2025. The law changes; this result reflects the position as at the tool’s last update.
The information you provided. See the practice’s privacy notice for what is collected, why, for how long, and what your rights are.
Advertising. This tool forms part of an advocate’s website and constitutes advertising under the Israel Bar Association (Advertising) Rules, 2001.
Unverified answers. The result is generated solely from answers you supplied. Nothing has been checked — not your systems, not your contracts, not the database register, not any document.
It does not discharge the duty. Using this tool does not appoint a Privacy Protection Officer, does not discharge any of the Law’s duties concerning a Privacy Protection Officer, and is not a substitute for an appointment.
Who wrote the logic. The questionnaire logic was written by Sod’s lawyers and reflects, among other sources, how the Privacy Protection Authority reads the Law in its opinion on appointing a Privacy Protection Officer — its stated interpretation, not decided law.
Also worth checking — You sell to customers in the EU or process EU residents’ data. The GDPR may apply alongside Israeli law, with its own officer test.
GDPR for Israeli CompaniesThe next step
What you receive: a written applicability opinion, the documentation pack (database definitions document, data security procedure, record of processing), and the agreements and procedures that follow.
On the answers you gave, there is a risk that the appointment duty applies to you, and only a case-specific review can decide it
The result is an indication of risk only, based on your answers, and is not legal advice.Full text
What this result is. The result above is an indication of risk only, based solely on the answers you provided. Your systems, documents, contracts and actual position have not been examined. It is not a determination that you do or do not comply with the law, it is not a legal opinion, and it is not legal advice. It must not be relied on as a substitute for a case-specific assessment.
No lawyer-client relationship. Completing the assessment, receiving the result, or contacting the practice afterwards does not create a lawyer-client relationship. Such a relationship arises only under a written, signed engagement letter.
The law cited. The provisions referred to are from the Privacy Protection Law, 1981, as amended by Amendment 13, in force from 14 August 2025. The law changes; this result reflects the position as at the tool’s last update.
The information you provided. See the practice’s privacy notice for what is collected, why, for how long, and what your rights are.
Advertising. This tool forms part of an advocate’s website and constitutes advertising under the Israel Bar Association (Advertising) Rules, 2001.
Unverified answers. The result is generated solely from answers you supplied. Nothing has been checked — not your systems, not your contracts, not the database register, not any document.
It does not discharge the duty. Using this tool does not appoint a Privacy Protection Officer, does not discharge any of the Law’s duties concerning a Privacy Protection Officer, and is not a substitute for an appointment.
Who wrote the logic. The questionnaire logic was written by Sod’s lawyers and reflects, among other sources, how the Privacy Protection Authority reads the Law in its opinion on appointing a Privacy Protection Officer — its stated interpretation, not decided law.
Also worth checking — You sell to customers in the EU or process EU residents’ data. The GDPR may apply alongside Israeli law, with its own officer test.
GDPR for Israeli CompaniesThe next step
“Significant scale” is the case-specific question a gap assessment answers: data mapping, a cumulative count across all your customers, and a reasoned determination in writing — including where the answer is that the duty does not apply.
On the answers you gave, the questionnaire did not identify a risk that the appointment duty applies to you
Three things change that answer: a new customer that is a public body; growth in cumulative sensitive-data exposure; and a change in your business that adds monitoring. The appointment duty is only one duty under the Privacy Protection Law — its absence does not mean there are no others, including the data security duties under the Law and the Privacy Protection (Data Security) Regulations, 2017.
The result is an indication of risk only, based on your answers, and is not legal advice.Full text
What this result is. The result above is an indication of risk only, based solely on the answers you provided. Your systems, documents, contracts and actual position have not been examined. It is not a determination that you do or do not comply with the law, it is not a legal opinion, and it is not legal advice. It must not be relied on as a substitute for a case-specific assessment.
No lawyer-client relationship. Completing the assessment, receiving the result, or contacting the practice afterwards does not create a lawyer-client relationship. Such a relationship arises only under a written, signed engagement letter.
The law cited. The provisions referred to are from the Privacy Protection Law, 1981, as amended by Amendment 13, in force from 14 August 2025. The law changes; this result reflects the position as at the tool’s last update.
The information you provided. See the practice’s privacy notice for what is collected, why, for how long, and what your rights are.
Advertising. This tool forms part of an advocate’s website and constitutes advertising under the Israel Bar Association (Advertising) Rules, 2001.
Unverified answers. The result is generated solely from answers you supplied. Nothing has been checked — not your systems, not your contracts, not the database register, not any document.
It does not discharge the duty. Using this tool does not appoint a Privacy Protection Officer, does not discharge any of the Law’s duties concerning a Privacy Protection Officer, and is not a substitute for an appointment.
Who wrote the logic. The questionnaire logic was written by Sod’s lawyers and reflects, among other sources, how the Privacy Protection Authority reads the Law in its opinion on appointing a Privacy Protection Officer — its stated interpretation, not decided law.
Also worth checking — You sell to customers in the EU or process EU residents’ data. The GDPR may apply alongside Israeli law, with its own officer test.
GDPR for Israeli Companies