Who this service is for

Suppliers to public bodies — ministries, local authorities, HMOs, hospitals

If a public body is your customer — a higher-education institution counts too — and you hold personal data on its behalf, the Privacy Protection Law requires you to appoint a Privacy Protection Officer. There is no scale test.

What you supply makes no difference — software or cloud, call-centre, payroll or billing services, outsourced IT, marketing. The practice sets out in writing whether the duty applies, and prepares the data security procedure and database definitions document that a public body’s tender or contract asks for.

Privacy ComplianceHolding a public body's data — the full picture

Businesses that handle sensitive data — health, finance, insurance

If your main business includes processing specially sensitive data at significant scale — a term with no numeric threshold — the Privacy Protection Law requires you to appoint an officer. Sensitive data held only for an ancillary purpose, such as employing staff, does not count here.

If you process such data for other businesses, the Privacy Protection Authority assesses the scale across all your customers together — so the duty can reach a clinic’s appointment-system provider, a claims or payroll bureau, or an insurance agency’s CRM provider. This is the Privacy Protection Authority’s guidance, not decided law.

What the practice examines:

Data classification

What in your systems is actually specially sensitive data, and where it sits

The contract with the institution you serve

What exactly you undertook, and what happens when its security annex changes

The incident scenario

Who reports to whom, and in what order

Risk AssessmentsContracts & Suppliers

Businesses that track customer behaviour — apps, online retail, marketing

If your main business involves regular and systematic monitoring of people — their behaviour, location or actions — at significant scale, for yourself or for others, the Privacy Protection Law requires you to appoint an officer, even if monitoring is not your purpose. The Privacy Protection Authority’s examples include app and website tracking, and profiling for targeted advertising.

The practice answers in writing whether that describes your business, with the reasoning either way, and prepares the documents that follow if the duty applies.

Privacy ComplianceMarketing & Newsletters

Businesses with customers in Europe — two regimes, one file

The GDPR can reach an Israeli business with no office in Europe. Offering goods or services to people in the EU brings it in, and so does monitoring their behaviour there — analytics, ad pixels, retargeting.

The practice keeps both regimes in one file — one processing map, a bilingual processing addendum, one privacy notice — and works in Hebrew and English.

GDPR for Israeli Companies