Data protection & privacy law in Israel (2026)
Data protection in Israel: comprehensive law.
Israel has a comprehensive, GDPR-adjacent data protection regime anchored in the 1981 Protection of Privacy Law and the Protection of Privacy Regulations (Data Security) 2017. Amendment 13, which took effect on 14 August 2025, redefined core concepts (personal data, controller/processor), introduced mandatory DPOs, overhauled registration, and gave the PPA direct administrative-fine powers that it has started using in 2026. Israel also retains an EU adequacy decision, reaffirmed by the European Commission on 15 January 2024.
Legal framework
Protection of Privacy Law, 5741-1981 (PPL), as substantially modernized by Amendment 13 (in force 14 August 2025); supervised by the Privacy Protection Authority (PPA) within the Ministry of Justice.
Key points: data & privacy in Israel
Primary law & regulator
Amendment 13 in force since Aug 2025
Amendment 13 (effective 14 August 2025) is the biggest reform in decades: it aligns definitions with GDPR concepts, narrows and modernizes database registration, mandates DPO appointment for certain controllers/processors, and empowers the PPA to impose administrative monetary penalties without court proceedings.
Enforcement and sanctions
The PPA now wields administrative fines ranging up to millions of shekels. In July 2026 it issued its first breach-notification fine of NIS 256,000 against the Meuhedet health fund; a separate NIS 12,000 fine was imposed on A.D Karting for notice failures.
Core obligations
Controllers must obtain informed consent, provide transparency notices (purpose, recipients, consequences of refusal, rights of access/rectification), implement the Data Security Regulations' tiered security measures, notify severe security incidents to the PPA, and — where thresholds apply (e.g., sensitive data on >100,000 subjects, systematic monitoring, or processing as core activity) — appoint a DPO with independence and reporting lines.
Data subject rights
Individuals have statutory rights of access (in Hebrew, English or Arabic), rectification and deletion of inaccurate/outdated data, and the right to object to use for direct-mail marketing. Amendment 13 did not introduce a general GDPR-style right to portability or erasure, but strengthened transparency and notice duties.
EU adequacy status
Timeline of decisions
- Law · officialAmendment 13 to the Protection of Privacy Law enters into force
The most sweeping reform of Israeli privacy law in decades takes effect, broadening 'personal' and 'sensitive' data definitions (IP addresses, geolocation, biometrics), mandating data protection officers, and converting the regulator into a full enforcement agency aligned with the GDPR.
Library of Congress (Global Legal Monitor)
- EnforcementFirst administrative fines imposed under Amendment 13
Shortly after the reform took effect, the Privacy Protection Authority used its new powers to fine an offender NIS 75,000 for repeated violations, signaling a shift to active, penalty-based enforcement.
AI-Law
- IncidentTel Aviv court approves Bank Discount / PayBox breach settlement
Following a 2020 data breach of the PayBox app, the Tel Aviv District Court approved a class-action settlement under which the bank pays NIS 3.02 million; the PPA had found security deficiencies in violation of the Privacy Protection Law.
ICLG
- LawKnesset approves Amendment 13 to the Protection of Privacy Law
The Knesset passed Amendment 13, the most sweeping overhaul of Israeli privacy/data-security law since 1981, modernizing definitions of sensitive data and overhauling enforcement. It is the legislative backbone for organizations' data-security obligations pending a dedicated cybersecurity statute.
Israel Tech Policy Institute
- LawKnesset approves Amendment 13
Israel's parliament passed the comprehensive privacy overhaul, introducing tiered turnover-based monetary sanctions and substantially enlarged enforcement powers for the regulator, with a one-year run-up to entry into force.
IAPP
- Decision · officialEuropean Commission renews Israel's data-protection adequacy
Following the GDPR-mandated four-year review, the Commission reaffirmed Israel as providing an adequate level of protection, preserving seamless EU-to-Israel personal-data transfers despite civil-society objections.
European Commission
- LawPrivacy Protection (Data Security) Regulations 2017 adopted
The Knesset approved detailed data-security rules classifying databases into four risk tiers with mandatory access controls, audits, and breach-notification duties; they entered into force in May 2018 alongside the GDPR.
IAPP
- Law · officialBiometric identification in ID documents becomes mandatory
A Knesset amendment ended the voluntary phase of the biometric program, requiring fingerprint/facial data on Israeli ID cards and passports, with data held in a secured, offline national biometric database separate from the Population Registry.
National Biometric Database Authority
- Decision · officialEU grants Israel data-protection adequacy (Decision 2011/61/EU)
Under Directive 95/46/EC the Commission recognized Israel as offering adequate protection for automated processing of personal data, enabling EU data transfers; the decision excludes territories administered since 5 June 1967.
EUR-Lex (European Commission)
- Law · officialBiometric Database Law enacted
The Knesset authorized collection of fingerprints and facial contours from all residents into a central biometric database for ID cards and passports, establishing the legal basis for Israel's biometric identity infrastructure.
Library of Congress (Global Legal Monitor)
- GuidanceILITA established as Israel's data-protection authority
Pursuant to Government Decision No. 4660, the Israeli Law, Information and Technology Authority was created in the Ministry of Justice to enforce privacy law and oversee databases; it was later renamed the Privacy Protection Authority.
IAPP
- Law · officialBasic Law: Human Dignity and Liberty enacted
This quasi-constitutional Basic Law anchors the rights to privacy, dignity and free expression that Israeli courts later weigh against state content-removal and site-blocking powers, the constitutional backdrop for all online-speech rulings.
Library of Congress
- Law · officialBasic Law: Human Dignity and Liberty enshrines privacy
The Knesset gave privacy constitutional status, declaring every person's right to privacy and to the confidentiality of their conversations, writings, and records, anchoring later data-protection jurisprudence.
Knesset
- Law · officialProtection of Privacy Law, 5741-1981 enacted
Israel passed one of the world's earliest comprehensive privacy statutes, creating database registration duties, civil and criminal liability for privacy infringement, and the foundation of the modern framework.
WIPO Lex
Sources
- gov.il/en/departments/the_privacy_protection_authority/govil-landing-page
- gov.il/en/pages/adequacy
- pearlcohen.com/israel-significant-amendment-to-the-privacy-law-takes-effect/
- pearlcohen.com/israel-issues-first-of-its-kind-administrative-fine-for-failure-to-re
- practiceguides.chambers.com/practice-guides/data-protection-privacy-2026/israel
- linklaters.com/en/insights/data-protected/data-protected---israel
- resourcehub.bakermckenzie.com/en/resources/global-data-and-cyber-handbook/emea/israel/topics/regula
- resourcehub.bakermckenzie.com/en/resources/global-data-and-cyber-handbook/emea/israel/topics/dpos-a
- iapp.org/news/a/european-commission-upholds-11-adequacy-decisions
- dpoisrael.com/en/amendment-13/
Next for Israel: Digital Payments & FintechLicensing regime
Next topicOrientation, not legal advice: verify against the primary sources linked above. Last verified 3 Oct 2026. Methodology & how to cite · State of Technology Regulation 2026