The Privacy Protection Law, 1981 does not require a document called a “privacy policy”. It requires a notice. When you ask a person for personal data in order to keep and use it in a database, for example through a form on your website, the request must come with a notice that sets out the details listed in section 11 of the Law. This is the duty to inform, and a website's privacy policy is usually where that notice is written out in full.
Amendment 13, in force since 14 August 2025, added three things to the notice: what happens if the person does not provide the data, who the controller of the database is and how to contact it, and the fact that the person has a right to see the data and ask for it to be corrected.
What the notice must state
The section lists five things the notice has to say. It is worth going through them one by one, because each of them is also a line in your policy:
- Whether the person is legally required to provide the data or whether it is up to them, and what happens if they do not agree. For example: giving a phone number is optional, but without it you cannot get back to them.
- Why you are asking for the data. You need to give all of the purposes. In the Privacy Protection Authority's view, a partial list that ends with “etc.” or “among other things” is, as a rule, not enough for the consent to be informed consent.
- Who the controller of the database is and how to contact it. This is usually the business itself, not its hosting provider.
- Who the data will be passed to and for what purpose. In the Privacy Protection Authority's view it is enough to name the type of recipient, such as “advertising companies”, but a label like “technology companies” may be too general.
- That the person has a right to see the personal data about them and to ask for it to be corrected.
The duty applies in every channel where you ask for data, not only a website form but also chat and telephone. In the Privacy Protection Authority's view, it applies even when the person contacted you first to get a service. And bear in mind that a “database” is almost any digital collection of personal data that the business uses.
What the law does not require, and what to include anyway
Some of what people expect to find in a privacy policy is not required in the notice by law. It is still worth writing down. The table separates what the law says from our recommendation.
| Topic | What the law says | Recommendation |
|---|---|---|
| Retention period | Not required in the notice. The Privacy Protection (Data Security) Regulations, 2017 require you to check once a year that you are not keeping more data than you need | Say how long each type of data is kept, and who may access it |
| Contact for privacy requests | You must give the controller's contact details. A body that is required to appoint a Privacy Protection Officer must also publish to the public how to contact the officer (section 17B2) | One address for access and correction requests |
| Transfers abroad | Not required in the notice. The transfer itself is governed by separate regulations | Say whether the data is stored or processed outside Israel |
| Service providers that process data for you | You must state to whom the data will be passed and why. The law does not mention service providers expressly | List the types of provider, such as hosting, mailing and customer management, and the role of each |
The rights the notice points to
Every person is entitled to see the personal data about them held in a database. If the data is not correct, complete, clear or up to date, they may ask for it to be corrected or deleted (sections 13–14 of the Law). You must allow access within 30 days of receiving the request, as the regulations on access to data provide.
Amendment 13 did not change the wording of these rights, but it widened what they apply to: under section 3, “personal data” now means any data relating to an identified person or a person who can be identified. The amendment also requires the notice to mention the rights, and it set sanctions for failing to honour them.
Damages and sanctions
A missing notice creates two kinds of risk. The first is a claim. Section 15A of the Law allows a court to award a person up to NIS 10,000 without them having to prove any damage, but only if they demanded the notice from you and 30 days have passed since that demand. So if such a demand reaches you, send the notice at once.
The second risk is a financial sanction that the Privacy Protection Authority may impose under section 23KV, calculated by the number of people. If you approached specific people, the sanction is NIS 50 for each person, and at least NIS 30,000 before reductions. If you approached an indefinite group of people, it is NIS 2 for each person whose data is in the database, and at least NIS 20,000. The Amendment 13 guide published by the Ministry of Justice and the Privacy Protection Authority gives “a link on a website” as an example of approaching an indefinite group. For specially sensitive data, the per-person amounts double.
The rights themselves are backed by damages too. If you did not allow access on time, did not make a correction you had agreed to, or did not give notice of a refusal, a court may award up to NIS 10,000 without proof of damage. Here no prior demand is needed. Refusing access, and not giving notice of a refusal to correct, are also grounds for a NIS 15,000 financial sanction (section 23KV(b)).
Micro and small businesses have lower ceilings under the Fifth Schedule to the Law, if they apply for them in time. The detail is in the article on Amendment 13. The amounts here are the sanction amounts written in the Law, and they are updated every year in line with the consumer price index.
Where the notice should appear
The Law says that a request to a person for data “shall be accompanied by a notice”. The Privacy Protection Authority adds that the notice should be “given at the same time as the approach to the person” (in its document on the duty to inform; our translation). So we recommend placing the notice next to the form, before the submit button, and not relying on a link in the page footer alone. In practice this means a few lines next to the form that cover the five points, with a link to the full policy. The Privacy Protection Authority also recommends offering the information at different levels of detail.
Cookies and tracking tools
Israel has no law specific to cookies. But “online identifier” appears in the definition of personal data, so data collected through cookies or pixels can be personal data. On browsing a website, the Privacy Protection Authority wrote in its opinion on consent of 25 February 2026 (our translation of the Hebrew original):
“A user's continued ‘browsing’ on a website, after being shown the information required to obtain their informed consent to the collection of data about them on entering the site (even if referred to further detail elsewhere on the site), will usually be treated as implied consent to the collection and use of the data.”
In the same document the Privacy Protection Authority adds a limit: such consent is valid only where there is a reasonable connection between the purposes for which the data is collected and the characteristics of the service. And there are cases where, in its view, continued browsing is not enough and active, separate (opt-in) consent is required. That is the position where the data is used for profiling the service does not need, between parties with unequal bargaining power, and where direct mail services are involved.
Our recommendation, as good practice and not a legal duty: a short banner when people enter the site, saying which tools run and why, and a way to refuse tools the site does not need in order to work.
Checklist
- Next to every form, it says whether providing the data is mandatory or optional, and what happens if it is not provided.
- All the purposes of collection are listed, without “among other things”.
- The notice gives the controller's name and contact details, the types of recipient, and the right to see the data and have it corrected.
- You have an internal procedure that answers access requests within 30 days.
- The same notice is given in every channel where you collect data, including phone, WhatsApp and paper forms.
- You update the notice whenever the use of the data changes. In the Privacy Protection Authority's view, a material change requires further consent.
Official sources
- Privacy Protection Authority — Duty to inform in the collection and use of personal data, version updated following Amendment 13 (Hebrew, PDF)
- Privacy Protection Authority — Opinion on consent under privacy protection law, 25 February 2026 (Hebrew, PDF)
- Ministry of Justice and Privacy Protection Authority — Guide to Amendment No. 13 to the Privacy Protection Law, May 2025 (Hebrew, PDF)
This is not legal advice
This article, like the rest of this site, is general information only. It is not legal advice or a legal opinion, and it does not address the circumstances of any particular organisation. The answer to your own question depends on the facts of your case, so do not rely on this article without advice that addresses them. Reading this article does not create a lawyer–client relationship.
The provisions referred to are from the Privacy Protection Law as amended by Amendment 13, in force from 14 August 2025. The Privacy Protection Authority's positions cited here are its own interpretation, not law decided by a court. The law changes, and what was accurate on the day of publication may not be accurate today. Current as at 7 October 2026.