Every incident procedure has a line about “notifying the authorities within the required time”. But the required time is exactly the question. For an Israeli company selling into Europe there are at least two answers, and they differ in what triggers the duty, who must receive the report and how much time you have.
Clock one: Israel, “immediately”
Regulation 11(d) of the Privacy Protection (Data Security) Regulations, 2017 requires a database controller to notify the Privacy Protection Authority immediately of a serious security incident. But before that duty applies, two conditions narrow it.
The first condition is the database's security level. The duty applies only to databases at the medium or high security level. A database at the basic level has no duty under the regulations to notify the Privacy Protection Authority, which is why the first step in any incident planning is to classify each database by its level.
The second condition is that the incident is “serious”. For a high-level database, any use of data from the database without authorisation or beyond it, and any harm to the database's integrity, is a serious incident. For a medium-level database it is the same, but only where a material part of the database is involved.
Until July 2026 there was nothing official explaining how fast “immediately” is. On 21 July 2026 the Privacy Protection Authority imposed a financial sanction on a health fund that reported late, and in doing so laid down the rule. According to the Privacy Protection Authority, the duty to report arises as soon as you learn that a serious security incident has occurred, and must be performed close to discovery and without delay. A position that you wait until all checks are complete “empties the immediacy requirement of content”. The report required is an initial one, based on what is known at the time, and further details can be filled in later in a supplementary report.
Timeliness is enforced on its own. The Privacy Protection Authority's announcement does not base the sanction on any harm caused. What was punished was the delay itself.
Clock two: the GDPR, 72 hours
The GDPR, Europe's data protection law, sets a different clock. Where it applies, Article 33 requires the controller to notify the competent supervisory authority of a personal data breach without undue delay and, where feasible, within 72 hours of becoming aware of it. The duty does not apply if the breach is unlikely to result in a risk to individuals. And where the risk to individuals is high, Article 34 requires that they be told too.
For a vendor, Article 33(2) matters most: a processor, meaning whoever processes data on the controller's behalf, must notify the controller without undue delay after becoming aware of the breach. So your clock starts running before your customer's does.
Clock three: whatever you signed
Data processing agreements with enterprise customers carry their own notification period: 24 hours, 48 hours or “without undue delay”. Sometimes they also require notice in a particular form to a particular address. A vendor with thirty customers may have thirty slightly different versions, so the procedure has to know what applies to each customer before the incident, not during it.
One procedure, one decision table
The answer that works is not a longer policy but a single decision table. It records the security level of each database, and the contractual commitment and contact for each customer. For each type of incident it sets out who decides it is “serious”, who reports to the Privacy Protection Authority, who reports to the customer, who reports to a European supervisory authority if the GDPR applies, and by when. All of it with names and telephone numbers.
When you build the table, keep three things in mind:
- The Israeli report is an initial one, and a supplementary report can follow. So do not hold it back for the forensic results.
- The GDPR clock runs from the moment you became aware of the incident. So record exactly when that was.
- Your commitment to the customer is a contract term. If you breach it, you have a contract problem on top of the regulatory one.
What this article is not
This is general information, not legal advice. The article reflects the Data Security Regulations, the Privacy Protection Authority's published announcement of its decision of 21 July 2026, and Articles 33–34 GDPR, as at 27 September 2026. Whether a given database is at the medium or high level, and whether the GDPR applies to you at all, depends on the facts of each case. Reading it does not create a lawyer–client relationship.