Not every Israeli company needs a GDPR project. Before you ask “are we GDPR compliant”, there are two earlier questions to answer: does Europe's data protection law reach you at all, and if so, by which route. The answer decides what you actually have to do and, just as important, what you do not.
When the GDPR reaches an Israeli company
The GDPR, Europe's data protection law, also applies to a company that is not established in the EU, and it does so by the two routes set out in Article 3(2) GDPR. The first is where the company offers goods or services to people in the EU. The second is where it monitors their behaviour within the EU.
In practice, Israeli companies are in one of three positions, and they are very different from each other. A company whose only link to Europe is a handful of people who signed up on their own through an English-language site is in one position. A company running campaigns aimed at an EU audience, with EU pricing, is in another. And a B2B vendor that processes personal data from the EU on behalf of an EU customer is in a third. The customer's obligations reach it through the contract, whether or not the GDPR applies to it directly.
The practical advice: decide which of these positions describes you, write down your reasoning, and stop answering questionnaires as if you were all three.
Transfers from Europe to Israel: adequacy is in force
The European Commission's adequacy decision for Israel, Commission Decision 2011/61/EU of 31 January 2011, is in force. On 15 January 2024 the European Commission published its first review report, in which it concluded that Israel continues to provide an adequate level of protection for personal data transferred to it from the EU. Israel also appears on the European Commission's current adequacy list.
This means that transferring personal data from the EU to Israel does not need standard contractual clauses (SCCs) or any other transfer mechanism. Commercially, that is a good opening position with a European customer, because it saves the deal a negotiation over those clauses and a transfer impact assessment for the Israeli part. So it is worth saying explicitly in the sales process, provided what you say is accurate.
Two qualifications go with it
- The adequacy decision does not cover law-enforcement transfers. The decision was adopted under the European directive that came before the GDPR, and it deals with automated processing. There is no separate adequacy decision for Israel under Directive (EU) 2016/680, which covers the law-enforcement sector.
- An adequacy decision is subject to periodic review by the European Commission, every four years (Article 97 GDPR), and the next review is expected around January 2028. So when contracting with a European customer it is sensible to hold standard contractual clauses as a fallback as well, rather than relying on adequacy alone.
What adequacy does not solve
Adequacy closes the transfer question, but only that question. The processor obligations under Article 28 GDPR still apply, so you still need a data processing agreement (DPA) that meets them. You still need records of your processing activities as well.
The question of whether you must appoint a data protection officer (DPO) under Article 37 GDPR also stays open. It is assessed separately from whether section 17B1 of Israel's Privacy Protection Law requires you to appoint a privacy protection officer, and the answers can differ. An appointment under one does not automatically satisfy the other. And if the GDPR reaches you by one of the two routes, you also need to check the duty to appoint a representative in the EU.
The EU representative: what it is, and what it is not
Article 27 GDPR requires a controller or processor that is not established in the EU, and that the GDPR reaches by one of the two routes, to appoint a representative in the EU, unless it falls within one of the exemptions in that article. That representative is not a DPO, and it does not replace one.
When GDPR work is needed
Work is needed when the GDPR reaches you by one of the two routes, or when an EU customer passes its obligations to you by contract. Even then it is focused. It starts with a reasoned opinion on whether the GDPR applies, saying which route, if any, and why. Then comes one processing map, used both for the Israeli documents and for the GDPR record of processing. Finally there is a bilingual data processing agreement, with one part for Israeli law and one for the GDPR, and a privacy notice that meets both regimes without contradicting itself.
Just as important: when neither route applies and no EU customer is passing obligations to you, that too is an answer, and it is given in writing in the same detail. Israeli law and the GDPR should be checked together, in one file. Otherwise you end up with two data maps that do not match, which is exactly what a customer or investor finds when they check you before a deal.
See the service page: GDPR for Israeli companies
Official sources
- European Commission — adequacy decisions
- European Commission — report on the first review of the adequacy decisions, COM(2024) 7 final (15 January 2024), EUR-Lex
This is not legal advice
This article, like the rest of this site, is general information only. It is not legal advice or a legal opinion, and it does not address the circumstances of any particular organisation. The answer to your own question depends on the facts of your case, so do not rely on this article without advice that addresses them. Reading this article does not create a lawyer–client relationship.
The article deals with Israeli law and the general structure of the EU regime. It does not deal with the domestic law of any EU member state. The law changes, and what was accurate on the day of publication may not be accurate today. Current as at 27 September 2026.