76%
of Israel's 21 requirements are already met by European Union (GDPR). Here is what PPL adds, biggest gaps first.
Lawful basisReach and lawful basisBig gap
GDPR1 Six lawful bases, including consent, contract, legal obligation, vital interests, public task and legitimate interests.
PPL adds3 Informed consent is the main basis; the alternative is statutory authority. There is no legitimate-interests basis, and new purposes need new consent.
ss. 1, 3, 8(b) · source ↗
RegistrationGovernanceGap
GDPR0 No general registration; controllers communicate DPO contact details to the supervisory authority.
PPL adds1 Registration only for public-body databases and databases of 10,000+ people mainly used to transfer data for payment; notify the PPA of special-sensitivity databases above 100,000 people.
s. 8A(a)(1)-(2), 8A(b) · source ↗
Tell the regulatorBreachesGap
GDPR2 Notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware, unless risk is unlikely.
PPL adds3 Report a severe security incident to the PPA immediately on discovery, through its online form.
Data Security Regulations 5777-2017, Reg. 11; PPA guidance of 7 Aug 2022 (amended 1 Sept 2025) · source ↗
LocalizationTransfersGap
GDPR– Not addressed
PPL adds1 No general localization; sector rules (e.g., Bank of Israel Directives 362 and 364) restrict offshoring of banking data.
No PPL provision; Bank of Israel Proper Conduct of Banking Business Directives 362, 364 · source ↗
Criminal liabilityEnforcementGap
GDPR1 Member States set other penalties, including criminal penalties, for infringements not subject to administrative fines.
PPL adds2 Privacy infringement and breach of confidentiality carry up to 5 years in prison; Amendment 13 added offenses such as obstructing or misleading the PPA (6 months to 3 years).
s. 5; s. 16; ss. 23BA-23BD · source ↗
Already covered by GDPR: Reach abroad, Consent, Sensitive data, Children, Rights, Request deadline, Marketing, DPO required, DPO qualifications, DPIA, Records, Retention, Tell people, Transfers abroad, Maximum fine, Private action.
A gap means PPL is more demanding than GDPR on that requirement, on our 0 to 3 scale (how we score). Read the cited section before acting. Not legal advice.
