Database registration after Amendment 13: who still has to register

Adv. Arthur Kartun · 7 October 2026 · Amendment 13 and the practical duties

Amendment 13 to the Privacy Protection Law, 1981 came into force on 14 August 2025, and since then section 8A of the Law has required only two kinds of database to be registered. The first is a database whose main purpose is collecting personal data in order to disclose it to another, as an occupation or for consideration, and which holds data on more than 10,000 people. The second is a database of a public body, such as a government ministry or a local authority, unless it holds data only about that body's employees. In the Privacy Protection Authority's words, the duty to register databases in the private sector was “almost entirely abolished”.

But an exemption from registration is not an exemption from the Law. A database that does not need registering, but holds specially sensitive data on more than 100,000 people, must be notified to the Privacy Protection Authority. And under the Privacy Protection (Data Security) Regulations, 2017, every database needs a database definitions document.

Who still has to register

Either of these two situations is enough:

“Direct-mail services”, as the Law defines them, are a service provided to others: passing on lists, labels or data. A business that mails its own customers is not providing that service. But personal data in a database that is used for direct-mail services may not be processed unless the database is registered and direct-mail services are one of its registered purposes (section 17D).

Databases registered before the amendment

Amendment 13 replaced the “Registrar of Databases” with the “Head of the Privacy Protection Authority”, who keeps the register. Under the transitional provision in section 76(a) of the Privacy Protection Law (Amendment No. 13), 2024, a database that was registered on the day the amendment came into force stays registered until its controller notifies the Privacy Protection Authority that the registration duty no longer applies to it. That notice has to be verified by affidavit. The Privacy Protection Authority stresses that a database kept on the register only under this transitional provision is not exempt from the notice duty.

The notice duty: sensitive data on more than 100,000 people

If a database does not need registering, but the number of people about whom it holds specially sensitive data exceeds 100,000, the controller must notify the Privacy Protection Authority (section 8A(b)). It has 30 days from the day the number crossed that threshold. Only people about whom there is sensitive data are counted, and under the Law that includes, among other things, data about a person's health, genetic data, data about a criminal record, and data about salary and financial activity.

The notice gives the controller's identity, address and contact details. If the controller must appoint a Privacy Protection Officer, the notice also gives the officer's identity and contact details. A copy of the database definitions document is attached to the notice.

According to the Privacy Protection Authority's online form, a database that crossed the threshold before 14 August 2025 gives 14 August 2025 as the crossing date. It follows that the 30 days for such a database run from the day the amendment came into force.

After the notice, the Privacy Protection Authority must also be updated within 30 days in three cases: when the identity of the controller or of the officer changes, or their contact details; when a change requires the database definitions document to be updated; and when the database stops operating.

This duty falls on the controller, not on a supplier processing data for it. And anyone who controls or holds five databases that require registration or notice must appoint an information security officer (section 17B(a)).

The database definitions document: who needs one and what goes in it

Regulation 2 of the data security regulations requires a definitions document for every database, at every security level. The duty is the controller's. A holder, meaning anyone processing data on the controller's behalf, is exempt from it. The document has to cover at least the following:

• It gives a general description of how data is collected and used, and for what purposes.
• It sets out the types of data in the database.
• It states whether the database, or a material part of it, is transferred outside Israel, or whether the data is used outside Israel, and if so, the details of the transfer.
• It describes the processing carried out through a holder.
• It sets out the main data security risks and how they are dealt with.
• It gives the names of the database manager, the holder and the information security officer, if one has been appointed.

The document must be updated whenever there is a significant change, and you must also check every year, by 31 December, whether an update is needed. The Privacy Protection Authority publishes a sample template, but it has to be adapted to your organisation.

Consequences of a violation

If a database must be registered and is not, data may not be processed in it until it is registered, and breaching that ban exposes the controller to a financial sanction under section 23KV(a) of the Law. In addition, an individual whose data is in the database can demand that it be registered. If 90 days pass and it is still not registered, that individual can claim statutory damages of up to NIS 10,000 without proving any damage.

Anyone who fails to give a notice or update they were required to give is also exposed to a financial sanction under the same section. And anyone who has no database definitions document, or whose document is out of date, is exposed to a sanction under the Third Schedule to the Law, in an amount that depends on the database's security level.

The sanction ceilings for micro and small businesses are set out in Amendment 13: what businesses need to know.

The first step: map your databases

Each of these duties starts with a list. Write down every collection of personal data the business processes by digital means, for example customers, employees, website enquiries and app users. For each database, check three things:

• Who its controller is. That is whoever determines the purposes of processing, and a supplier processing data for a customer is a holder, not a controller.
• What the database's main purpose is, how many people it holds data about, and about how many of them it holds sensitive data. The answers decide whether the database needs registration, notice, or neither.
• What is already registered. For databases registered before the amendment, you need to decide whether to keep them on the register or ask for them to be deleted.

The output is a definitions document for each database. According to the Privacy Protection Authority, this document is also the basis for classifying databases by the security levels in the regulations.

Risk Assessments

Official sources

• Privacy Protection Authority: application to register a database (Hebrew)
• Privacy Protection Authority: duty to notify a database (Hebrew)
• Privacy Protection Authority: the database definitions document (Hebrew)
• Privacy Protection Authority: guide to Amendment 13 (Hebrew, PDF)