Data security levels: how to tell which level your database is at

Adv. Arthur Kartun · 7 October 2026 · Data security and incidents

Israel's Privacy Protection (Data Security) Regulations, 2017 divide databases into four levels: a database managed by an individual, the basic level, the medium level and the high level. The level is set for each database separately, and it decides which duties apply to it. To work out which level your database is at, you look at what data it holds and about how many people, how many authorised users it has, what its purpose is, and who owns it: a public body, an individual or another organisation.

The four levels and what decides each

The lightest level is a database managed by an individual. Under the definition in regulation 1, it applies when the database is run by one person, or by a corporation owned by one person, and only that person and at most two other authorised users can use it. But even such a database is not at this level in three cases: when it holds data on 10,000 people or more, when its main purpose is collecting data to pass to others as a business (including direct mail), and when it holds data subject to a professional confidentiality duty.

A database is at the medium level if any one of three conditions applies. First, its main purpose is collecting data to pass to others as a business, including direct mail. Second, its owner is a public body, such as a government ministry or a local authority. Third, it holds a type of data that appears on a special list in the First Schedule to the regulations.

That list covers data on the privacy of a person's personal life, medical or mental-health data, and genetic data. It also covers political opinions or religious beliefs, criminal records, communications data and biometric data. And it has two more types: data on a person's assets, debts and financial situation, and consumption habits that reveal one of these types of data (other than the financial data) or a person's personality, beliefs or opinions.

A database with data from the list can still stay at the basic level. That is possible only when the list is the sole reason the database reached the medium level, and only in one of two situations. In the first, the database has no more than ten authorised users. In the second, the listed data is only about the business's employees or suppliers and is used only to run the business. Even then, it must not include data on personal life, genetic data, opinions or beliefs, biometric data other than facial images, or consumption habits.

Under the Second Schedule to the regulations, a database moves up to the high level when two things are true together. First, it holds data from the list, or its main purpose is passing data to others. Second, it holds data on 100,000 people or more, or it has more than 100 authorised users. A public body's database reaches this level only if both these conditions are met for it too. Note that the ten-user exception is set only for the medium level, so do not assume it takes such a database out of the high level.

Every database that does not fall into one of these three levels is at the basic level.

What changes from level to level

Regulation 21 sets out which regulations apply at each level, and the duties build up. Each level carries all the duties of the level below it and adds more. The table sets out the main ones:

Security events must be documented at every level (regulation 11(a)). But the duty to report a serious event to the Privacy Protection Authority applies only at the medium and high levels. What counts as a “serious security event” at each, and what “immediately” means, we explain in The two clocks of breach notification.

Amendment 13 and “specially sensitive data”

Amendment 13 to the Privacy Protection Law, 1981 came into force on 14 August 2025 and added a new list to section 3 of the Law: “specially sensitive data”. The data security regulations were not amended to match, so they still classify databases by their own list. The two lists mostly overlap, but they are not the same. The Law's list includes, for example, a person's origin, personality assessments and data subject to a confidentiality duty set by law. The regulations' list includes consumption habits, which do not appear on the Law's list.

The amendment also added the Third Schedule to the Law, which sets financial sanctions for breaching the data security regulations, in amounts that depend on the database's security level. For the purpose of those sanctions, the Schedule defines the four levels itself, this time by the new list. The Privacy Protection Authority has explained, in a guide it updated after the amendment, what the Schedule's definitions are for (our translation of the Hebrew original):

“The definitions of the security levels... are indeed relevant to the amount of the financial sanction that may be imposed for breach of the Regulations... but these definitions do not determine the security level that applies to the database for the purposes of the Regulations themselves, or for the purposes of the duties that apply to the database under the Regulations.”

In practice, your duties follow the regulations' list, while the sanction for breaching them follows the Schedule's definitions. The gap between levels is large. The sanction for the same breach is 20 times higher at the medium level than at the basic level, and at the high level it is 4 times higher than at the medium level. For a high-level database with data on a million people or more, the amount can be doubled (section 23KV(h) of the Law).

Classifying in three steps

1. List each database separately: what it holds and why. If you are a vendor processing data for a customer, check the customer's database too, because its level sets most of your duties (regulation 19(a)).
2. Check the database's purpose and owner against the conditions described above. Check the data types against both lists, because the regulations' list sets the duties and the Law's list affects the sanction.
3. Count how many people the database holds data about and how many authorised users it has, and compare them with the thresholds described above. For authorised users the thresholds are two additional, ten and more than 100, and for people they are 10,000 and 100,000. An authorised user is anyone with access to the data, to the database systems or to what is needed to operate the database, including IT administrators. A vendor that is not an individual, and anyone who got access through it, are not counted.

It is worth recording the result in the database definitions document, where regulation 2 already requires you to describe the data types. It is also worth reviewing it whenever something significant changes, and at least once a year, by 31 December.

Risk Assessments