Cybersecurity law & regulation in Israel (2026)

Legal framework

No horizontal cybersecurity statute. Obligations arise from the Regulation of Security in Public Bodies Law, 5758-1998 (critical infrastructure), the General Security Service Law, 5762-2002 (Shin Bet/ISA role), the Protection of Privacy Law, 5741-1981 and Protection of Privacy Regulations (Data Security), 5777-2017 (data breach duties), and sectoral regulator directives (notably Bank of Israel Proper Conduct of Banking Business Directives 361/364). A National Cyber Protection draft bill was published in January 2026 but is not yet enacted.

Key points: cybersecurity in Israel

1. 01Critical infrastructure directives

   The Regulation of Security in Public Bodies Law, 5758-1998 empowers the ISA (Shin Bet) and the National Cyber Directorate to issue binding information-security and cybersecurity directives to listed essential organizations (telecoms, utilities, transport, stock exchange, ccTLD registry, etc.) and to inspect their compliance.

   practiceguides.chambers.com loc.gov

2. 02Data breach notification duty

   Under the Protection of Privacy Regulations (Data Security), 5777-2017, owners of 'medium'/'high' security databases must immediately notify the Privacy Protection Authority of a severe security incident; the PPA can order notice to affected data subjects. Amendment 13 to the Privacy Law took effect on 14 August 2025, significantly expanding PPA enforcement powers.

   pearlcohen.com practiceguides.chambers.com

3. 03Financial sector cyber rules

   Bank of Israel Proper Conduct of Banking Business Directive 361 (cyber defence management) was consolidated with Directives 357 and 363 into the updated framework (Directive 364), mandating board-level governance, risk management, drills, continuous monitoring, and incident reporting to the Supervisor of Banks and INCD without undue delay.

   boi.org.il pearlcohen.com

4. 04National Cyber Directorate role

   The INCD, established in 2017 and recognized by Government Resolutions and a 2019 Knesset amendment, operates CERT-IL, issues voluntary guidance (e.g., Cyber Defence Methodology for an Organisation 2.0), and coordinates national incident response, but lacks horizontal statutory enforcement powers pending the draft National Cyber Protection Law.

   loc.gov en.idi.org.il

5. 05Proposed horizontal law (2026 draft)

   In January 2026 the government published a draft National Cyber Protection Law that would apply to 'essential organizations' (government, telecoms, energy, health, transport, data centres, PaaS/SaaS, cybersecurity service providers, online platforms) and impose risk-based security obligations, mandatory incident reporting, monetary sanctions and potential criminal liability. It is still in consultation and not expected to be enacted before 2027.

   lexology.com pearlcohen.com

6. 06Shin Bet (ISA) role under 2002 law

   The General Security Service Law, 5762-2002 formally gives the Israel Security Agency responsibility for protecting designated computerized systems and critical infrastructure from cyber threats; this task has been progressively shifted toward the civilian INCD but ISA retains statutory authority for the most sensitive entities.

   ccdcoe.org en.wikipedia.org

Timeline of decisions

1. 1 Jan 2026Law
   National Cyber Protection Law draft bill 5786-2026 published for public comment

   Israel published a draft National Cybersecurity Law creating binding obligations for 'essential organizations' (energy, health, telecom, transport) and large digital/storage service providers, with incident-reporting duties, INCD supervision, monetary sanctions up to ILS 640,000 and possible criminal liability. It is the long-awaited attempt to put the National Cyber Directorate's powers on a statutory footing after the failed 2018 bill.

   Barnea Jaffa Lande

2. 13 Oct 2021Incident
   Ransomware attack cripples Hillel Yaffe Medical Center

   A ransomware attack locked the Hadera hospital out of all digital systems for weeks (≈ILS 36 million in losses), becoming a landmark national incident; the INCD had earlier warned the hospital of unaddressed vulnerabilities. It triggered sector-wide INCD warnings and accelerated healthcare cybersecurity regulation.

   Times of Israel

3. 1 Jul 2019Law · official
   Knesset amendment formally recognizes the National Cyber Directorate's defensive role

   A legislative amendment gave statutory recognition to the National Cyber Directorate's role in protecting Israel's cyberspace, an interim step after the comprehensive 2018 cyber bill stalled. It clarified the INCD's legal standing pending a full cybersecurity law.

   U.S. Library of Congress

4. 20 Jun 2018Law
   Draft Cyber Security and National Cyber Directorate Bill published

   The Prime Minister's Office published a draft bill to give the INCD far-reaching powers, compelling production of information, issuing binding instructions, entering premises and seizing computer material to handle cyberattacks. It drew heavy criticism over privacy and oversight and ultimately failed to advance.

   Council on Foreign Relations

5. 8 May 2018Law
   Privacy Protection (Data Security) Regulations 5777-2017 enter into force

   These regulations, effective alongside the EU GDPR, impose tiered data-security obligations on all database holders, access controls, encryption, audits, staff training, written security policy and breach notification to the Privacy Protection Authority within 72 hours. They remain the core operative cybersecurity/data-protection compliance rules.

   Lexology

6. 17 Dec 2017Decision
   Government merges cyber bodies into the Israel National Cyber Directorate (INCD)

   A government resolution unified the National Cyber Bureau and the National Cyber Security Authority into a single Israel National Cyber Directorate within the Prime Minister's Office, responsible for the full civilian cyber-defense lifecycle from policy to operational defense. This created the central regulator that shapes today's framework.

   Wikipedia (Gov. Resolution)

7. 7 Aug 2011Decision
   Resolution 3611 establishes the National Cyber Bureau

   Government Resolution 3611, 'Advancing National Cyberspace Capabilities,' created the Israel National Cyber Bureau in the Prime Minister's Office to set cyber policy, protect critical infrastructure and coordinate across government, academia and industry. It is the foundational document of Israel's centralized civilian cyber governance.

   National Security Archive

8. 11 Dec 2002Decision
   Resolution B/84 creates the critical-infrastructure protection regime

   Special Government Resolution B/84 assigned protection of computerized critical infrastructure to the Israel Security Agency (Shin Bet) via a new National Information Security Agency (Re'em/NISA), requiring supervised bodies to follow mandatory IT-security instructions. It was one of the world's first centralized CIP frameworks and the origin of Israel's cyber obligations.

   Connections / PfP Consortium

Sources

1. 1.practiceguides.chambers.com/practice-guides/cybersecurity-2024/israel
2. 2.practiceguides.chambers.com/practice-guides/data-protection-privacy-2026/israel
3. 3.loc.gov/item/global-legal-monitor/2019-07-22/israel-knesset-passes-amendment-
4. 4.pearlcohen.com/israel-publishes-draft-bill-on-national-cyber-protection/
5. 5.lexology.com/library/detail.aspx?g=7020c34c-c9a1-48fa-858d-50ddbd8c4e05
6. 6.pearlcohen.com/israel-issues-first-of-its-kind-administrative-fine-for-failure-to-re
7. 7.boi.org.il/media/gbujh1ub/h2680_en.pdf
8. 8.ccdcoe.org/uploads/2018/10/IL_NCSO_final.pdf
9. 9.pearlcohen.com/bank-of-israel-issues-proper-conduct-of-banking-business-directive-on
10. 10.en.idi.org.il/articles/63760
11. 11.en.wikipedia.org/wiki/National_Cyber_Security_Authority_(Israel)