Personal data in AI tools: what a business may enter and on what terms

Adv. Arthur Kartun · 19 October 2026 · AI and privacy

Israeli law has no general ban on AI tools, but the Privacy Protection Law applies to their use in full. A business may enter personal data into a chatbot, an assistant or a transcription service only for a use that fits the purpose for which the data was collected and what people were told, and only into a tool whose provider is engaged as an outside vendor on terms that limit what it does with the data. Specially sensitive data, such as health or salary data, is better masked or left out. The Privacy Protection Authority's guideline on AI is still a draft, but under it an organisation whose staff use outside AI tools needs a dedicated internal policy.

The law applies, and the guideline is still a draft

Under the Privacy Protection Law, 1981, as amended by Amendment 13, “processing” means any operation on personal data, including passing it on, so typing a customer's details into a chatbot is processing. In its draft guideline on applying the Law to AI systems, dated 28 April 2025, the Privacy Protection Authority takes the position that the Law applies to a model that stores or processes personal data, both when it is trained and when it is used, and that personal data an AI system creates, including inferences and assessments, is subject to the Law. The draft deals expressly with employees who use outside tools such as ChatGPT, even without a formal engagement by the organisation.

As at 19 October 2026 the guideline is still a draft. The Privacy Protection Authority's July 2026 recommendations on AI agents still call it a draft, and we found no final version. A draft does not bind, but it states the interpretation the Privacy Protection Authority intends to apply in supervision and enforcement.

Purpose, notice and sensitive data

The first question is what the data was collected for. Section 8(b) of the Law allows personal data in a database to be processed only for the database's lawfully set purpose, and section 2(9) treats using information about a person's private affairs, or passing it on, for a purpose other than the one for which it was given as an invasion of privacy. The Privacy Protection Authority's final opinion on consent, of 25 February 2026, adds that consent to use data for one purpose does not permit its use for another.

A tool that does part of the job the data was given for, such as summarising a customer's inquiry in order to answer it, mainly raises questions about the provider. The purpose rule comes into play when the data goes to a use people were not told about, such as training the provider's model, profiling, or a decision about a person.

If you ask people for data that an AI system will process, the notice under section 11 of the Law, as amended by Amendment 13, must state, among other things, the purpose, to whom the data will be passed and why, and the controller's name and contact details. The draft adds that the explanation should describe how the system processes personal data and the risks of each purpose, including training, and that people should be told when they are giving data to a bot, where that may materially affect their consent. For a purpose beyond what people would reasonably expect, the draft calls for more explicit consent, such as a separate opt-in.

Section 3 of the Law defines “specially sensitive data”, which includes health data, salary data and financial activity, biometric identifiers, personality assessments and data subject to a confidentiality duty set by law. There is no separate AI rule for this data, but the draft treats sensitivity as a sign of high risk, and similar data on the data security regulations' own list can raise a database's security level.

The tool's provider is an outside vendor

An AI provider that processes your data on your behalf is a “holder” under the Law, and under section 17 the controller and the holder are each responsible for the security of the data. The draft treats an organisation's use of an outside AI tool as an engagement to which regulation 15 of the Privacy Protection (Data Security) Regulations, 2017 applies. That regulation requires a risk check before the engagement, an agreement that sets out, among other things, what data the vendor may process, for what purposes and how it is returned or destroyed at the end, and supervision in proportion to the risks. For AI tools, the draft adds two points to weigh: how long the provider keeps what is entered, and whether it can be stopped from using it for training or for other purposes beyond your database's purpose. If a tool's standard business terms do not answer these points, it is not the place for personal data.

The security level of the database the data comes from decides which duties apply; regulation 15, for example, does not apply to a database managed by an individual. The draft expects many databases whose systems are based on AI to be at the medium or high level, and we explain how to classify in Data security levels. When the provider processes the data outside Israel, as is common with AI tools, the transfer needs a basis under the regulations on transferring data abroad and a written undertaking from the recipient, as set out in Transferring personal data out of Israel. The provider's processing and any transfer abroad belong in the database definitions document, under regulation 2 of the data security regulations.

Questions to ask before data goes into a tool

Before material goes into an AI tool, it is worth working through these steps in order:

• Check exactly what will go in, and whether the task can be done without personal data, by removing identifiers or entering only the passage that is needed. Removing a name is not always enough, because under the Law data is personal if the person can be identified by reasonable effort, directly or indirectly.
• Check whether any of it is specially sensitive or subject to a confidentiality duty. If it is, the decision belongs to whoever is responsible for privacy in the organisation.
• Make sure the use fits the purpose for which the data was collected and what people were told.
• Use only a tool the organisation has approved, under the organisation's account and terms, never a personal account.
• Find out where the provider processes the data, how long it keeps it and whether it trains on it.
• Decide what happens to the output. If it will be saved with a person's record or used for a decision about them, it is personal data in its own right.

Where an answer is unclear, stop and ask.

AI agents, which act in other systems rather than only answer, call for more caution. The Privacy Protection Authority's July 2026 recommendations on AI agents are addressed to the public for personal use and leave business processing to the draft guideline, but they show the practice the Privacy Protection Authority regards as sound: access only to the data the task needs, view-only permissions where possible, and a person's approval before certain actions, such as sending an email.

What an internal AI-use policy covers

On outside generative AI tools, the draft guideline says (our translation of the Hebrew original):

“This change requires database controllers to prepare appropriately and to set a dedicated organisational policy that will address the security risks arising from it.”

According to the draft, the policy and the security procedures should address, among other things, five matters:

• Who in the organisation may use an outside AI tool, who approves that use, for what purpose, and which types of personal data may be entered.
• The security risks of each tool, and how regulation 15 is met for it.
• Which outside tools employees may use and which they may not.
• Rules for using a permitted tool so as to reduce the risks, such as refusing the use of queries for training and keeping query retention to a minimum.
• Training employees on the particular security risks of generative AI.

The draft also recommends a privacy impact assessment before AI systems are used to process personal data, certainly high-risk ones. Israeli law does not require one, as the draft notes, but in the Privacy Protection Authority's view it is the best way to check and show compliance. In the draft's view, the privacy protection officer is often well placed to coordinate AI matters, at least until a dedicated role is appointed. Broader AI governance standards, such as ISO/IEC 42001, are covered in our article on AI governance standards.

AI Use Privacy Review