Counting across customers: what counts toward “significant scale” for a holder

Adv. Arthur Kartun · 27 September 2026 · Amendment 13 and the practical duties · Updated 7 October 2026

Say your business is a holder, meaning it processes personal data for many customers. It might be a software or cloud provider, a payroll bureau, a call centre or a clinic appointment system. You may have looked at Amendment 13 and concluded that you are too small: each customer's database is modest, so the “significant scale” tests do not apply to you. Since 14 July 2026 that reasoning has a problem.

When an officer must be appointed

Section 17B1(a) of the Privacy Protection Law, 1981 requires a Privacy Protection Officer to be appointed in four situations. Two of them are fairly clear-cut: being the controller or the holder of a public body's database (paragraph (1)), and dealing in data on more than 10,000 individuals (paragraph (2)). The other two depend on scale. One is regular and systematic monitoring of people “at significant scale” (paragraph (3)), and the other is a principal occupation that includes processing specially sensitive data “at significant scale” (paragraph (4)).

Section 17B1(b) sets out what decides whether the scale is significant. You look at how many people the data relates to and what proportion of the population they are, how much data there is, how many types of data, how long and how often it is processed, how long it is kept, and what geographic area it covers. But the Law does not say how a service provider that processes data for many customers is to be counted.

What the Privacy Protection Authority added

The Privacy Protection Authority's final opinion of 14 July 2026 on appointing an officer answers that question at paragraph 9.12. For a holder, which is the statutory term for someone who processes data for another, scale is assessed cumulatively. In other words, you take into account all the people whose data sits in the databases of all the customers you process data for. The Privacy Protection Authority gives its own example: a holder providing processing services to 1,000 databases, each holding specially sensitive data on only 100 data subjects, is regarded as processing specially sensitive data at significant scale (the opinion, in Hebrew, PDF).

Many holders may look exactly like that. They have one service, hundreds of customers and a few hundred records for each customer, but they have never added the numbers up.

Two important qualifications

The first: this is the Privacy Protection Authority's guidance, not decided law. An opinion explains how the Privacy Protection Authority intends to use its powers, and no court has yet ruled on the cumulative count. It is the position you will meet if the Privacy Protection Authority opens an inquiry into you, which is reason enough to plan around it. But it is not a statute.

The second: the guidance deals only with whether the appointment duty applies to you. It says nothing about how a financial sanction would be calculated.

What to count, and what not to

The cumulative count applies only to the two situations that depend on scale, and only where the data is of the relevant kind. So the first step is to classify your data. What you count is specially sensitive data, or people who are being monitored. A holder whose service keeps ordinary contact details for thousands of people does not count toward the specially sensitive data test at all.

If the data is of the relevant kind, you count across all your customers, not customer by customer. The question is the total across every controller you serve, including customers with tiny databases.

And if you cannot say how many people's sensitive data you hold in total, that is an answer too, but one that needs work. It is in effect the first finding of a gap assessment.

What follows if the count catches you

If you are caught, the same things apply to you as to any organisation that must appoint an officer. You must appoint one individual, with the knowledge the Law requires, who has no role that conflicts with this one (section 17B3(a) and (c)). The officer must report directly to the CEO, or to someone who reports directly to the CEO, and must be given the resources the role needs (section 17B2(b) and (c)). You must also publish how to contact the officer. The Law expressly allows the officer to be someone who is not an employee of the organisation (section 17B3(b)).

And if the count does not catch you, that is also an answer. It is worth having it in writing, at the same level of detail, for the next customer questionnaire that asks.

Privacy self-check · 3 min