Publications
Articles on privacy protection, data security and EU law
Articles
Counting across customers: what counts toward “significant scale” for a holder
The two clocks of breach notification
Who can be the Privacy Protection Officer — and who cannot
Does your company need GDPR compliance?
Amendment 13: what businesses need to know
Israel's Amendment 13 fines: how much, for what, and what reduces them
Database registration after Amendment 13: who still has to register
Website privacy policy: what Israeli law requires it to say
Data security levels: how to tell which level your database is at
Workplace cameras in Israel: what employers may and may not do
Transferring personal data out of Israel: when it is allowed and how to do it right
Privacy lawyer in Israel: when a business needs one and what they do
Personal data in AI tools: what a business may enter and on what terms
AI governance: ISO 42001, NIST AI RMF and the EU AI Act
Cyber incident reporting in Israel: who else you may have to tell
Get these updates once a month by email — subscribe to the newsletter
Privacy Protection Authority updates
What the Privacy Protection Authority has published since Amendment 13 came into force — sanctions, opinions and guidance — newest first, each linked to the official announcement.
- The Ministry of Education breached its data security duties after medical data on about 21,000 pupils was exposed through an open link. Its ISO 27001 certification did not exempt it from the Data Security Regulations.
- A NIS 64,000 sanction on Beit Shemesh Municipality: a supplier with access to its welfare database was not listed as a holder in the database definitions document, and its security procedure did not regulate outside access.
- Four accounting firms chosen by tender will help the Privacy Protection Authority carry out its cross-sector inspections.
- A NIS 12,000 sanction on a karting company whose online sign-up form collected ID numbers and children’s details without the notice the law requires. Its request for a warning instead was refused.
- The first sanction under Amendment 13: NIS 256,000 on the Meuhedet health fund for not reporting a serious security incident immediately.
- The final opinion on appointing a Privacy Protection Officer: who must appoint one, what the officer does and what is required of them. A supplier that only stores or views a public body’s data must appoint one too.
- Recommendations to the public on using AI agents safely: expose as little data as possible, grant as few permissions as possible, and approve any irreversible action yourself.
- A document for public comment for websites, social networks and online games: how to verify users’ age with the least intrusion on privacy.
- The Administrative Warning Regulations came into force: in some cases the Privacy Protection Authority can issue a warning instead of a financial sanction.
- The final opinion on transferring personal data abroad to a recipient that has agreed by contract to keep the conditions that apply to a database in Israel, and what such an agreement needs.
- The final opinion on consent: when consent is valid and how it must be asked for, including on websites and in apps. The Privacy Protection Authority will apply it in inspections and sanctions.
- The Privacy Protection Authority began publishing preliminary opinions it gave organisations that asked for them. Each binds only the organisation that asked, on the facts it presented.
- A draft for public comment on which measures count as “accepted” for making sure only authorised people can access a database.
- A clarification: using AI to “undress” or degrade a person in a photo without their consent may be a prohibited invasion of privacy, a criminal offence and a civil wrong.
- The first cross-sector inspections under Amendment 13: local authorities, online retailers, widely used apps, genetic screening institutes and after-school programmes.
- The Privacy Protection Authority launched a digital tool that helps organisations identify privacy risks and the duties Amendment 13 places on them.
- The Privacy Protection Authority’s professional guide to Amendment 13: the new definitions, the narrower registration duty, the duty to appoint an officer, financial sanctions and the new offences.
- The Privacy Protection Authority announced it would not enforce the duty to appoint an officer until 31 October 2025, to let organisations complete the appointment.
Official sources
The practice is not responsible for the content or availability of these sites.