Amendment 13: what businesses need to know

Adv. Arthur Kartun · 27 September 2026 · Amendment 13 and the practical duties · Updated 7 October 2026

Amendment 13 to the Privacy Protection Law, 1981, came into force on 14 August 2025. It widened the duties businesses carry, and it also changed the nature of supervision: the Privacy Protection Authority no longer just keeps a register of databases, it enforces. On 21 July 2026 it imposed a financial sanction of NIS 256,000 on a health fund that did not promptly report a serious security incident. The Privacy Protection Authority held that “the immediate-reporting duty arises upon becoming aware of the occurrence of a serious security incident”, and rejected the argument that notification can wait until an internal investigation is complete.

This article sets out what a business needs to know, particularly a company that processes personal data for its customers: when you must appoint a Privacy Protection Officer, how the Privacy Protection Authority measures the scale of processing at a supplier like that, and what the law actually says about sanctions and damages.

The four situations that require an officer

Section 17B1(a) of the Law lists four situations in which you must appoint a Privacy Protection Officer. Each one is enough on its own, so if any one of them applies to you, you have to appoint.

1. The first, in paragraph (1): a public body that controls a database, and also anyone who holds a database for such a body. A public body, as defined in section 23 of the Law, is, for example, a government ministry, a local authority, a health fund, a hospital or a higher-education institution, among others. There is no size test here. The only question is whether the customer is a public body and whether you hold or process its personal data.
2. The second, in paragraph (2): the controller of a database whose main purpose is collecting personal data to pass it on to others, as an occupation or for payment (either one is enough), for example a direct-mail service. This is the only situation with a hard numeric threshold: data on more than 10,000 people. Someone who merely holds such a database is not caught by this situation.
3. The third, in paragraph (3): a controller or holder whose main activities include processing that requires regular and systematic monitoring of people, such as tracking their behaviour, location or actions, at significant scale. It is enough that your core activity in fact involves this kind of monitoring, even if monitoring is not its purpose.
4. The fourth, in paragraph (4): a controller or holder whose main activity includes processing specially sensitive data at significant scale. Processing only for an ancillary purpose, such as employing staff, does not count. “Significant scale” is judged by several factors listed in section 17B1(b), with no numeric threshold, and they do not all have to be met.

A common mistake: 10,000 people is not a general threshold for appointing an officer. That figure belongs only to the second situation, a business whose occupation is collecting data to pass on to others. It has nothing to do with the monitoring or sensitive-data situations.

The situation suppliers miss: holding a public body's database

The first situation does not apply only to the public body itself. The law also puts the duty on anyone who holds its database, and that is the whole point: if a public body's personal data sits on your servers, you are a holder, and the duty to appoint an officer is yours, not only your customer's.

And the bar is low. Any operation on the data counts as processing, even if you only store it or only view it. So it is enough that the customer is a public body and that you do anything at all with its personal data. In that case you are a holder, and the duty to appoint an officer applies to you.

Note too what is not here: no “significant scale” test, no discretion, and no dependence on company size. A twelve-person supplier, such as a software provider, payroll bureau or call centre, with one local-authority customer whose personal data it holds, is caught by this situation. A two-hundred-person company with no public-sector customer may stay outside it.

The aggregation rule: scale is measured across all customers together

In a final opinion of 14 July 2026 on appointing an officer, the Privacy Protection Authority set out a rule that changes the picture for service providers. In its words (our translation of the Hebrew original):

“The scope of processing performed by a holder must be assessed cumulatively, aggregating all data subjects across the databases of all the controllers to which it supplies processing services. For example, a holder supplying processing services to 1,000 databases, each holding specially sensitive data on only 100 data subjects, will be treated as processing specially sensitive data on a significant scale.”

In practice, a supplier that assumed the duty does not apply to it, because no single customer reaches “significant scale” on its own, is not necessarily right. You can run the Privacy Protection Authority's own example against your customer list: 1,000 databases, with sensitive data on 100 people in each, add up to significant scale, even though no single customer does. So if you process data for customers, the number that decides is not the number of people at your largest customer. It is the total across all of them.

The sanction ceilings: what the law actually says

A small business's exposure to a financial sanction is set by the Fifth Schedule to the Law. It splits businesses into two tiers by turnover, and each tier has three groups of violations. These are the ceilings:

A few rules change the actual amount. A business that commits several violations across more than one group does not pay the sum of them, only the highest of the applicable ceilings at most. A business that stopped the violation on its own initiative and reported it to the Head of the Privacy Protection Authority gets a 30% reduction. And all reductions together are capped at 70% of the sanction.

There is also a condition that is easy to miss. The ceilings in the table do not apply automatically. They apply only if you ask for them and attach certification of your turnover, within 30 days of receiving the notice of intention to impose a sanction. Miss the 30 days and you lose the ceiling. The same rule applies to the separate cap of 5% of turnover.

A range of “NIS 20,000–50,000” circulates in the market. It is wrong, because it merges the two turnover tiers into one and drops the third group entirely. In fact there are two tiers and three groups, which makes six figures.

Damages without proof of damage

For a small business, the bigger risk is usually not the sanction. It is an enterprise customer that stops working with you, a deal that stalls in due diligence, or a claim by an individual. Amendment 13 added section 15A, which allows damages of up to NIS 10,000 per violation, with no need to prove damage, on six grounds the law lists.

This is a new route, separate from the damages section 29A already allowed: up to NIS 50,000, or up to NIS 100,000 where there was intent to harm, both index-linked. On three of the six grounds, access, correction and deletion, no prior demand is needed, so an access request you left unanswered can by itself found a claim. And only an individual can sue this way. A corporation has no such claim.

Where to start

The first question is not how big the fine is, but which situation applies to you, if any. To check, we built a questionnaire of eight questions that takes three minutes. The result also explains what in the law it rests on.

Privacy self-check · 3 min