Who this service is for
Holding a public body's data
Any business that serves a government ministry, a local authority, an HMO, a hospital or a higher-education institution and holds personal data on its behalf — a software or cloud provider, a call centre, a payroll bureau, a collection company, a contractor
What the law says
The Privacy Protection Law puts the duty to appoint a Privacy Protection Officer on:
a controller of a database that is a public body as defined in the Law, or a holder of such a database.
The words “or a holder” mean the duty is not the public body's alone. The Law defines a holder as an outside party that processes data for the controller, and storing or merely viewing the data counts as processing. There is no scale test: if you process personal data on such a customer's behalf, the duty applies. Whether a customer is a public body, and whether your arrangement makes you its holder, is what a written answer settles.
Who counts as a “public body”
The Law and the Privacy Protection (Designation of Public Bodies) Order, 1986 expressly include government ministries, local authorities, HMOs, hospitals, higher-education institutions and workers' organisations. A government company or a municipal corporation is not automatically a public body — only if it performs a statutory public function or is listed in the Order.
When you serve many customers
The Privacy Protection Authority assesses a holder's processing cumulatively, across all the customers it serves; in its own example, a holder processing data for 1,000 databases, each holding specially sensitive data on only 100 people, is regarded as processing such data at significant scale. A payroll bureau, a call centre or a software provider serving many small clients can look like that — without knowing it.
This is the Privacy Protection Authority's guidance (its opinion on appointing a Privacy Protection Officer, in Hebrew, PDF), not decided law, and it goes to whether the appointment duty applies — not to the size of any financial sanction.
When this usually surfaces
| The event | What breaks |
|---|---|
| A customer sends a security and privacy questionnaire | No documents are ready, and the answers get written in a hurry |
| A tender or an engagement with a public body | You are required to attest to an officer, a data security procedure and a database definitions document |
| An incident or an inspection at your public-body customer | The arrangements with suppliers are examined too: Beit Shemesh Municipality was fined NIS 64,000, partly because a supplier with access to its welfare database was not listed as a holder. |
| An investment, a merger or a sale of the business | The buyer or investor examines privacy as a separate part of due diligence |
| A security incident | The first question is who reports, to whom, and within what time |
A 90-second check
- Is at least one of your customers a government ministry, a local authority, an HMO, a hospital or a higher-education institution?
- Does personal data on that customer's behalf — patients, residents, students, employees — sit on your systems or with a sub-processor of yours, or do you process it for the customer in its own systems?
- If both answers are yes, and the customer is a public body under the Law and the Order, the appointment duty applies, with no scale test. If not, the duty can still apply on one of three other grounds, and the full check goes through them.
Treating work inside the customer's own systems — remote access, viewing the data — as “holding” is our reading of the Law's definitions of holder and processing. We know of no court ruling or Privacy Protection Authority publication that addresses it yet.
This page is not an opinion on your position. Whether the duty applies to you is answered in writing, after examination — including when the answer is “no”.
What you get from us
For a supplier to a public body we provide four things, as the supplier needs them.
| What | What it contains |
|---|---|
| A written answer | Whether your customer is a public body, whether your arrangement makes you its holder, and whether the appointment duty applies to you — signed by a lawyer, including when the answer is “no”. |
| Privacy Protection Officer | If the duty applies, one of our lawyers fills the role: availability for day-to-day questions, a documented annual training cycle and a single point of contact with the Privacy Protection Authority. |
| The agreement with the public body | A processing agreement and a security annex that set the terms of your access to the data: for which purposes, which types of data, in which systems and for how long. |
| Tender documents | What public-body tenders ask of a supplier: a statement on the officer, a data security procedure and a database definitions document. |