Since Amendment 13 to the Privacy Protection Law, 1981, the Privacy Protection Authority can impose a financial sanction, which most people call a fine. It is imposed on the controller of a database, or on a holder that processes data in it, for violations the Law lists. For each violation the Law sets either a fixed amount or an amount per person in the database, and that amount can be reduced only in the cases and by the rates the Law itself sets. By October 2026 the Privacy Protection Authority had imposed three such sanctions: NIS 256,000 on a health fund, NIS 64,000 on a municipality and NIS 12,000 on a karting company over its sign-up form.
What can be fined, and how much
The Law lists a long range of violations. These are some examples that matter to most businesses:
| Violation | Amount |
|---|---|
| Refusing a request to see data, failing to correct data, or failing to remove a person from a direct-mail database (section 23KV(b)) | NIS 15,000 |
| Collecting data from people without the notice the Law requires, or unlawful direct mail, per person approached (section 23KV(c)) | NIS 50 |
| The same collection from an open-ended audience, such as through a form or link on a website, per person in the database (section 23KV(d)) | NIS 2 |
| Failing to appoint a data security officer, or failing to appoint a Privacy Protection Officer at a public body or a data broker, per person in the database (section 23KV(d)) | NIS 2 |
| Processing data for an unlawful purpose, or without the controller's authorisation, per person in the database (section 23KV(e)) | NIS 4 |
Where the amount is calculated per person, the Law also sets a minimum that the Privacy Protection Authority may impose. For collecting without notice or unlawful direct mail, the minimum is NIS 30,000. For the NIS 2 violations it is NIS 20,000, or NIS 40,000 where sensitive data is involved. And for unlawful processing it is NIS 200,000.
A breach of the Privacy Protection (Data Security) Regulations, 2017, is priced differently. Here the amount is fixed in the Law's Third Schedule by the provision breached and the database's security level, and it ranges from NIS 1,000 for a database managed by an individual to NIS 320,000 for a database at the high security level.
A supplier that processes data for a customer, in other words a holder, can be fined in its own right. And there is a situation in which the customer, the controller, pays too: if the supplier was fined for breaching the Data Security Regulations, the breach was not stopped, and the customer did not act to stop it as the Privacy Protection Authority instructed. In that case the customer can be fined the same amount (section 23KV(j)).
What increases the amount
The first factor is the number of people in the database, because a per-person amount adds up fast. Specially sensitive data, such as medical data, salary data, biometric data or criminal records, doubles the per-person amount. The Ministry of Justice's guide gives the example of a website link that collects data without the required notice, in a database of 500,000 people with sensitive data. The fine in that example comes to NIS 2,000,000.
For a database at the high security level holding data on a million people or more, the Privacy Protection Authority may double the amount for a breach of the Data Security Regulations. Time matters too, and section 23L of the Law deals with it in two situations. If the violation continues after you have received a payment demand, 1% of the fine is added for each day. And if you repeat a violation of the same provision, after the payment date and within two years of the previous violation for which a fine was imposed, the fine is doubled.
What reduces the amount
The Law's Fifth Schedule (section 23LA) lists several situations in which the amount comes down. These are the main ones:
- 30% if you stopped the violation on your own initiative and reported it to the Head of the Privacy Protection Authority.
- 20% if no fine or administrative enforcement measure was imposed on you for the same provision in the five years before the violation, and 10% if none was imposed in the three years before it.
- 20% if you took steps to prevent a recurrence and to reduce the harm, and the Head of the Privacy Protection Authority was satisfied with them.
- Up to 30% if you paid compensation for the same violations, or compensation was awarded against you.
Together, the reductions come to 70% at most. Beyond them there are two caps, which apply even to a fine that has already been reduced. But they do not apply automatically, and you have to ask for them.
The first cap is for a micro or small business, meaning a business whose turnover in the year before the violation was up to NIS 4 million, or up to NIS 10 million. The level of the cap depends on the size of the business and the type of violation, and the full table is in Amendment 13: what businesses need to know, along with the wider picture. The second cap is open to any violator, of any size: you can ask that the fine not exceed 5% of your turnover. Either way you need certification of your turnover from an accountant (for some businesses, a representative tax adviser will also do), and it must be filed within 30 days of the day you received the notice of intended charge.
The process: from notice of intended charge to publication
Before the Privacy Protection Authority imposes a fine, it sends a written notice of intended charge. The notice sets out the violation, the amount and your rights. From the moment you receive it you have 45 days to argue against the fine and against the amount (sections 23KZ–23KH). If you do not, the notice becomes a payment demand when the period ends.
From the day you receive the payment demand you have 45 days to pay, and within the same 45 days you can also appeal to the Magistrates' Court (section 23ME). An appeal does not suspend payment unless the Privacy Protection Authority agrees or the court orders it. The fine is also published on the Privacy Protection Authority's website, with the violation, the amount and the reductions. Where the violator is a corporation, its name is as a rule published too, and the publication stays up for four years.
In some cases the Privacy Protection Authority can issue a warning instead of a fine, for example for a first breach of certain data security provisions. This is allowed by the Privacy Protection (Administrative Warning) Regulations, 2026.
The health fund sanction
According to the Privacy Protection Authority, the fund knew of the incident as early as November 2025, but reported it only on 27 January 2026. For failing to report immediately in this way under regulation 11(d) of the Data Security Regulations, the Law sets NIS 80,000 for a database at the medium security level and NIS 320,000 at the high level. The Privacy Protection Authority's announcement does not set out the calculation. It says only that the sanction was set “after reductions in accordance with the provisions of the law”.
“The immediate-reporting duty arises upon becoming aware of the occurrence of a serious security incident, and must be performed close to the time of discovery and without delay. A position that one should wait for all checks to be completed empties the ‘immediacy’ requirement of content.”
A sign-up form without notice
On 5 August 2026 the Privacy Protection Authority imposed NIS 12,000 on a company that runs karting activities. Its online registration form collected ID numbers, dates of birth and details of the user's child, without the notice that section 11 of the Law requires: the purposes of the data, who will receive it, who controls the database and how to reach them, and the right to see and correct the data. A full privacy policy went up on the site only after the inquiry began. The amount started at NIS 20,000 and came down to NIS 12,000 because the company had no previous violations and took steps to prevent a recurrence. The Privacy Protection Authority rejected the argument that the matter was trivial, and refused to settle for an administrative warning instead.
“The duty to inform is one of the fundamental, substantive duties of privacy protection law, and not a technical duty.”
A supplier missing from the database documents
On 16 September 2026 the Privacy Protection Authority imposed NIS 64,000 on Beit Shemesh Municipality, after a fault in its GIS system exposed welfare data, including medical data, on about 4,600 residents. The sanction was for two breaches of the Data Security Regulations that the inquiry found. A company that had supported the system, with access to the database for almost two years, was a holder, yet the municipality had not listed it as one in the database definitions document (regulation 2(a)(7)). And its security procedure did not set out what an outside party with access may do: the purposes, the types of data, the systems it may reach and the term of the engagement (regulation 15(a)(3)). Each breach was set at NIS 40,000, and the total of NIS 80,000 was reduced by 20% because no sanction had been imposed on the municipality for the same provisions in the previous five years. Its argument that Amendment 13 had come into force only a week before the incident was rejected, because organisations had a full year to prepare.
Privacy Protection Authority announcement of the sanction, 16 September 2026 (Hebrew)
Fines, damages and criminal offences
A financial sanction is an administrative process. The Privacy Protection Authority imposes it, and the money goes to the State Treasury. But it is not the only risk. An individual can sue you in court and be awarded statutory damages under section 15A of the Law, of up to NIS 10,000 per violation, without proving any harm. This is possible on six grounds the Law lists, such as an access request left unanswered, and a fine already imposed on you does not bar such a claim.
Some violations are also criminal offences. Processing data from a database without the controller's authorisation, for example, carries up to three years' imprisonment. However, section 23MZ(b) provides that once a notice of intended charge has been delivered, no indictment will be filed for the same violation unless new facts come to light.
Where to start
Start with five things. First, classify each database by its security level, because that level sets the fine for data security breaches. Second, check that every form that collects personal data carries the notice the Law requires, because its absence is what the karting company was fined for. Third, list every supplier with access to a database as a holder in its definitions document, and set out in the security procedure what that supplier may do, because those two gaps are what the municipality was fined for. Fourth, keep a procedure for an immediate initial report of a serious security incident, because failing to make exactly that report is what the health fund was fined for. And fifth, prepare the turnover certification in advance. It is due within 30 days, before the 45 days for arguments run out.
This is not legal advice
This article, like the rest of this site, is general information only. It is not legal advice or a legal opinion, and it does not address the circumstances of any particular organisation. The answer in your case depends on its facts. The law changes, and what was accurate on the day of publication may not be accurate today, so do not rely on this article without advice on your own matter. Reading it does not create a lawyer-client relationship.
The provisions and amounts referred to are from the Privacy Protection Law as amended by Amendment 13, in force from 14 August 2025. Amounts are given as set in the Law, and section 23LB(b) updates them by the consumer price index every 1 January, starting in 2026. The descriptions of the three sanctions are based on the announcements published by the Privacy Protection Authority. Current as at 14 October 2026.