A business needs a privacy lawyer, also called a data protection lawyer, when the personal data it holds puts a legal decision in front of it: which duties apply, what to sign, what to report and to whom, and how to answer the Privacy Protection Authority or someone bringing a claim.
Amendment 13 to the Privacy Protection Law, 1981, in force since 14 August 2025, widened the duties of businesses that hold personal data. Since then the Privacy Protection Authority has had the power to impose monetary sanctions under section 23KV of the Law, and an individual can claim damages for certain violations without proving they suffered any damage.
When to call a privacy lawyer
The basic reason is to check which duties apply to the business since Amendment 13, including whether section 17B1 of the Law requires you to appoint a Privacy Protection Officer. Sometimes the question comes from outside: an enterprise customer sends you a privacy and security questionnaire, or a data processing agreement (DPA) to sign, and you need to understand what you are committing to.
In a security incident, time is short. Where the incident is serious and the database is at the medium or high security level, it must be reported to the Privacy Protection Authority immediately, under regulation 11(d) of the Privacy Protection (Data Security) Regulations, 2017. In the Privacy Protection Authority's view, the duty arises on becoming aware of the incident, not when the checks are finished.
A letter from the Privacy Protection Authority is also a reason to call a lawyer. It may be a demand for information or documents, notice of an administrative inquiry, or a notice of intent to impose a monetary sanction on you. That notice can be contested within 45 days (sections 23KZ–23KH of the Law). If you do not contest it in time, the notice itself is treated as a demand for payment.
The same goes for a demand letter or a claim, including a motion to certify a class action.
An individual claim can also come without any proof of damage. For violations that section 15A of the Law lists, such as an access request left unanswered, a court may award an individual damages of up to NIS 10,000 per violation, without the person having to prove they suffered damage.
A business with links abroad has more to check. If you offer goods or services to people in the European Union, or monitor their behaviour there, you may also be subject to the GDPR, Europe's data protection law, under its Article 3(2). And if your data sits with a cloud provider abroad, transferring personal data out of Israel is subject to the conditions in the regulations on transferring data abroad, and the contract with the provider must meet the Data Security Regulations.
A product that collects specially sensitive data, such as health data, biometric identifiers or financial data, may raise the security level a database requires under the First Schedule to the Data Security Regulations. In some cases it also triggers a duty to appoint a Privacy Protection Officer or to notify the Privacy Protection Authority. Finally, an investment or acquisition involves privacy and data security due diligence, and a lawyer handles it for the business under review or for the investor or buyer.
What a privacy lawyer does
A privacy lawyer maps which duties apply to the business and on what basis, and what each of them requires in practice. They draft and review the documents: the privacy notice, data processing agreements with customers and suppliers, the database definitions document, the data security procedure and the incident procedure.
They also advise and represent. Before the Privacy Protection Authority, that covers incident reports, responses to demands and arguments against an intended monetary sanction. And they represent you against whoever sends you a demand letter or files a claim against you. In all of this they work alongside the information security team, on the same incidents, suppliers and questionnaires, each in its own field.
Legal advice on privacy and technical security work are different jobs. Security staff configure and monitor the systems and investigate what happened in an incident. The lawyer establishes what the law requires, what goes into the contract, and what is reported, to whom and when. In a security incident, both work in the same hours.
A Privacy Protection Officer is a third role, which the law defines separately. If you are under a duty to appoint one, section 17B3(b) of the Law allows you to appoint an officer who is not an employee of the business.
What to prepare for a first conversation
It helps to come to the conversation with a picture of your data and your documents. These are the things worth writing down:
- What personal data you hold and about whom, for example customers, users, patients or employees, as well as data you process for customers.
- Where the data is stored: which systems, which cloud providers and which countries.
- Which suppliers have access to the data, and what you signed with them.
- Which documents you already have, such as a privacy notice, contracts and procedures, and any letter, demand or statement of claim you have received.
- By when you must respond, sign or report.
A partial list is enough to contact us. And if a deadline is running, mention it in your first message.
This is not legal advice
This article, like the rest of this site, is general information only. It is not legal advice or a legal opinion, and it does not address the circumstances of any particular organisation. The law changes, and something that was accurate on the day it was published may not be accurate today. The answer to your own question depends on the facts of your case, so do not rely on this article without advice that addresses them. Reading this article does not create a lawyer-client relationship.
It refers to the Privacy Protection Law as it stands after Amendment 13, in force from 14 August 2025, to the Data Security Regulations, and to the Privacy Protection Authority's published announcement of its decision of 21 July 2026. Current as at 7 October 2026.