Services
Inspections & Sanctions
When the Privacy Protection Authority contacts you — with an inspection, a demand for documents or a notice of intent to impose a monetary sanction — we represent you before it. We prepare the answer and the documents, argue against the sanction and ask for the reductions the law allows, and appeal to the court where needed.
Four questions that decide the next step
Where you stand with the Privacy Protection Authority decides what needs doing, and by when.
| # | Question | Why it is decisive |
|---|---|---|
| 1 | Has the Privacy Protection Authority opened an inspection, asked for documents or started reviewing your sector? | You need an orderly answer, and the documents the law requires you to keep: the database definitions document, the data security procedure and the list of access permissions. |
| 2 | Have you received a notice of intent to impose a monetary sanction? | You have 45 days to make your case, in writing or orally. Without it, the notice becomes a demand for payment. |
| 3 | Have you received a demand for payment? | You can appeal to the Magistrates’ Court within 45 days. The appeal does not stop the payment by itself. |
| 4 | Did you find a breach yourselves? | Stopping it and reporting it on your own initiative earns a reduction in the sanction, if one is imposed. |
What we do
We are with you at every stage of the process, from the first answer to an appeal.
| Stage | What it covers |
|---|---|
| Responding to an inspection | Preparing the answer and the documents the Privacy Protection Authority asks for, and attending the meetings with its inspectors. |
| Your exposure | How high the sanction could go — by the number of people in the database, the type of data and how long the breach lasted — and which reductions apply to you. |
| The hearing | Written or oral arguments: the facts, the steps you have already taken, and the requests for reduction. |
| Appeal | An appeal to the Magistrates’ Court against a demand for payment. |
| A correction plan | Steps that prevent a repeat. They ground a reduction, and they are what the Privacy Protection Authority will check next time. |
How it runs
The work runs to the deadlines in the Privacy Protection Authority’s letter.
- First call
- We read the Privacy Protection Authority’s letter together and mark the deadline.
- Scope letter
- Deliverables, timetable and terms of engagement, in writing, before work starts.
- Collection
- The facts, the documents and the steps you have already taken.
- Response
- The answer to the inspection, or the arguments against the sanction, within the deadline.
- Continuation
- An appeal if needed, and a correction plan that prevents a repeat.
- 1. First call
- 2. Scope letter
- 3. Collection
- 4. Response
- 5. Continuation
Questions people ask
What happens when we receive a notice of intent to impose a monetary sanction?
You have 45 days to make your case, in writing or orally. If you do not, the notice becomes a demand for payment. After a demand you pay within 45 days, or appeal to the Magistrates’ Court within 45 days; an appeal does not suspend payment by itself. A sanction on a company is published on the Privacy Protection Authority’s website for four years.
How is a monetary sanction calculated?
By the type of breach: a fixed amount, an amount for each person contacted, or an amount for each person whose data is in the database — doubled for specially sensitive data, and with a minimum. There is no multiplier based on turnover; turnover only caps the sanction, since you may ask that it not exceed 5% of your turnover. Reductions of up to 70% in total are available, among others to a business that stopped the breach and reported it on its own initiative, and to one that took steps to prevent a repeat.
Is the Privacy Protection Authority actually imposing sanctions?
Yes. Among others, it imposed NIS 256,000 for a security incident that was not reported immediately, and NIS 12,000 for an incomplete notice on an online sign-up form and in the privacy policy; in the second case it rejected the argument that the breach was trivial.