Services
GDPR for Israeli Companies
The GDPR can reach an Israeli company with no office in Europe. We check whether it applies to you, and handle Israeli and EU law in the same file: one mapping, one processing addendum and one privacy notice that meet both.
Four questions that decide whether EU law reaches you
European law reaches an Israeli business through one of these situations.
| # | Question | Why it is decisive |
|---|---|---|
| 1 | Do you offer goods or services to people in the EU? | If so, the GDPR may apply to you, even without an office in Europe. |
| 2 | Do you monitor their behaviour there — analytics, ad pixels, retargeting? | Monitoring the behaviour of people in the EU can bring the GDPR in too. |
| 3 | Do you process data for a European customer? | The customer will ask for a processing addendum, a mapping and questionnaire answers, and the question of whether you need a representative in the EU will come up. |
| 4 | Has personal data reached you from Europe? | Israeli regulations add duties of deletion, accuracy and notice for it, and they apply to any database it is mixed into. |
Deliverables
Each deliverable is written to meet both laws at once.
| Deliverable | What it contains |
|---|---|
| Processing map | One map, feeding both the database definitions document and the GDPR record of processing activities. |
| Data processing addendum | A bilingual data processing addendum, with an Israeli module and a GDPR module. |
| Privacy notice | An external privacy notice that satisfies both regimes without contradicting itself. |
| Applicability opinion | Whether the GDPR reaches you, and whether you need a representative in the EU. |
| Questionnaire answers | Standard answers to the recurring questions in customers’ security and procurement questionnaires. |
| Data from Europe | A check of personal data that reached you from Europe: the extra duties Israeli law places on it, and whether to keep it separate. |
| Shared processes | Incident reporting, data subject rights and the question of appointing an officer each get one process that meets both laws’ different requirements. |
How it runs
The work runs in five steps, and the scope is set in writing before it starts.
- Initial fit call
- A first discussion of the need, scope and priorities.
- Scope letter
- Deliverables, timetable and terms of engagement, in writing, before work starts.
- Collection
- A questionnaire and documents, then two to three conversations with the relevant people on your side.
- Delivery
- The deliverables, then a handover session on the gaps and the order to address them.
- Continuation, if you want it
- Ongoing support or filling the officer role.
- 1. Fit call
- 2. Scope letter
- 3. Collection
- 4. Delivery
- 5. Continuation
Questions people ask
Does the GDPR apply to an Israeli company with no EU office?
It can: where the company offers goods or services to people in the EU, or monitors their behaviour there. Selling into Europe, or processing EU residents' data for a European customer, is usually what brings it in — not the location of the servers.
How do we reconcile the requirements in Israel and in Europe?
In one file. We map your processing once, against both the Privacy Protection Law and the GDPR, and write one privacy notice and one bilingual data processing addendum that satisfy both. Your incident procedure is built for both clocks: for a serious security incident, immediate reporting to the Privacy Protection Authority in Israel, and notification to the European supervisory authority within 72 hours where feasible. Where the two regimes ask for different things, the documents say which rule applies to which activity, so your team works to one set of procedures.
Do we need an EU representative?
A controller or processor outside the EU that the GDPR reaches — because it offers goods or services to people in the EU, or monitors their behaviour there — must appoint a representative in the EU, unless the processing is occasional, low-risk and involves no large-scale special-category data. Whether the exemption applies is a case-specific question.
Does Israel's adequacy decision mean we are covered?
It means personal data can come from the EU to your company in Israel without a separate transfer mechanism, where it is processed by automated means. It does not make the GDPR apply, and it does not remove any duty that does apply.
Does data from Europe change our duties in Israel?
Yes. Israeli regulations from 2023 add duties for personal data transferred from the European Economic Area: deletion at the person’s request in set cases, a mechanism that keeps no data that is no longer needed, accuracy, and notifying the person within a month of receiving the data. If that data sits in the same database as everything else, the duties apply to the whole database, which is why keeping it separate is often the simpler route.