Services
Privacy Compliance
We check whether businesses that hold personal data for themselves or for a customer comply with the Privacy Protection Law (and in particular its Amendment 13). They include clinics, insurance agencies, online stores and apps that track customers, call centres, payroll bureaus, software and cloud providers, and contractors to ministries or local authorities. At the end you know which duties apply to you, and you receive the documents, agreements and procedures the law requires.
Four basic, essential questions
These four questions decide which duties apply to you, and what to deal with first.
| # | Question | Why it is decisive |
|---|---|---|
| 1 | Do you have a customer that is a public body? | If you hold its database on its behalf, you must appoint a Privacy Protection Officer, whatever the scale. Public bodies include government ministries, local authorities, HMOs, public hospitals and higher-education institutions. |
| 2 | Is handling sensitive data or tracking people at the core of your business — and at what scale? | If your main business involves regular and systematic monitoring of people, or processing specially sensitive data, the duty to appoint a Privacy Protection Officer applies when this is done at significant scale. Sensitive data only about your own staff is not enough. |
| 3 | Do your contracts and privacy notice describe what you actually do? | If not, the gap shows up when a customer sends a questionnaire or an incident occurs. |
| 4 | What happens in your first 24 hours after an incident? | According to the Privacy Protection Authority, the duty to report a serious security incident immediately arises on becoming aware of it, and does not wait for an internal investigation to finish; it has already imposed a NIS 256,000 monetary sanction for late reporting. |
Deliverables
At the end of the work you receive these deliverables, written for your business.
| Deliverable | What it contains |
|---|---|
| Applicability opinion | A detailed, comprehensive answer on whether the Privacy Protection Officer duty applies to you, on which ground, and what it requires of you. |
| Gap assessment | Mapping of your personal-data flows and databases, assessment against the Privacy Protection Law and the Data Security Regulations, and a gap list ranked by exposure. |
| Documentation pack | Database definitions document, data security procedure, record of processing activities, an external privacy notice, the notice beside each form that collects data, and a retention and deletion schedule. |
| Access and deletion requests | A procedure for access, correction and deletion requests, with the deadlines the law sets and their exceptions. |
| Data processing agreements | Drafting and negotiation of DPAs with customers and suppliers, in Hebrew and English, including a European customer’s requirements. |
| Incident procedure | Reporting procedure, a decision table for who reports to whom and within what time, and a pre-drafted preliminary notification. |
| Training and management briefing | Training for staff before they get access to the data, and one session with management or the board: what applies, what was decided, and what is minuted. |
How it runs
The work runs in five steps, and the scope is set in writing before it starts.
- Initial fit call
- A first discussion of the need, scope and priorities.
- Scope letter
- Deliverables, timetable and terms of engagement, in writing, before work starts.
- Collection
- A questionnaire and documents, then two to three conversations with the relevant people on your side.
- Delivery
- The deliverables, then a handover session on the gaps and the order to address them.
- Continuation, if you want it
- Ongoing support or filling the officer role.
- 1. Fit call
- 2. Scope letter
- 3. Collection
- 4. Delivery
- 5. Continuation
Questions people ask
Does a private business have to appoint a Privacy Protection Officer?
Only if one of the four grounds in the Privacy Protection Law applies: holding a public body's database, data brokerage over 10,000 individuals, regular and systematic monitoring at significant scale, or a principal occupation that includes processing specially sensitive data at significant scale. Sensitive data held only about your own staff is not enough for the fourth.
Who supports us after the project?
We do. After delivery you can continue with us for ongoing support: answers to day-to-day questions, review of new contracts, products and suppliers, and updates to your documents when your business or the law changes. From time to time we go over with you and your management what has changed and what needs updating. If you need a Privacy Protection Officer, one of our lawyers can fill the role. The lawyers who know your file stay with you.