Regulations › Rest of world › Israel
PPL
Protection of Privacy Law, 5741-1981
WhenIn effect since 14 August 2025
Who enforces itPrivacy Protection Authority (PPA), Ministry of Justice
Who it applies toAnyone who infringes privacy, and owners, holders and processors of personal-data databases in Israel, including public bodies.
Tell the regulatorReport a severe security incident to the PPA immediately on discovery, through its online form
DPO requiredRequired for public bodies, data brokers and direct mailers above 10,000 people, and entities…
RegistrationRegistration only for public-body databases and databases of 10,000+ people mainly used to tra…
Transfers abroadAllowed only if the destination's protection is no lower than Israel's, or under listed except…
Request deadline30 days, per secondary sources
Maximum fineTiered administrative fines, many per data subject (e.g., ILS 4-8 per person for sensitive dat…
Every requirement we score, with the rule in plain words and the section it comes from. Darker means more demanding. See every law side by side →
Reach and lawful basis
Reach abroad
1
No express extraterritorial clause; the PPA applies the law where processing has a material impact on Israelis, e.g. targeting the Israeli market or local servers.No statutory provision; PPA interpretation and case law · secondary source · source ↗
Sources disagree. The IL Tech Policy brief says the law reaches only entities within Israel's jurisdiction, while Chambers 2026 describes broader PPA practice. Treat this cell as uncertain.
Lawful basis
3
Informed consent is the main basis; the alternative is statutory authority. There is no legitimate-interests basis, and new purposes need new consent.ss. 1, 3, 8(b) · secondary source · source ↗
Consent
1
Consent must be informed and may be express or implied; courts and the PPA increasingly require specific, unbundled consent. Express consent is needed for electronic marketing.s. 3 (definition of consent); Aviv v Meta (2025) · secondary source · source ↗
The statute accepts implied consent. It is scored 1 because spam-law opt-in and PPA guidance require express consent for some uses.
Sensitive data
1
'Information of special sensitivity' is broadly defined (incl. biometrics, location, financial data). It brings higher security levels, PPA notification above 100,000 people, DPO triggers and higher fines, but no ban.s. 3 (definition, as amended); s. 8A(b); s. 17B1 · secondary source · source ↗
There is no explicit-consent rule in the statute, although PPA guidelines (2025) prefer explicit consent. Section numbering follows the IL Tech Policy brief and LOC.
Children
0
No age threshold in the PPL; minors under 18 lack full legal capacity, so parental consent is generally needed.Not in PPL; Legal Capacity and Guardianship Law, 5722-1962 · secondary source · source ↗
People's rights
Rights
2
Access, correction or deletion of inaccurate data, deletion from direct-mail databases (opt-out), and erasure for EEA-origin data.ss. 13, 14, 17F; Regulations on Data Transferred from the EEA, 5783-2023 · secondary source · source ↗
Counted 4 rights: access, correction, deletion and objection (direct mail only). Deletion and objection are narrow, and there is no portability, restriction or automated-decision right.
Request deadline
2
30 days, per secondary sources.s. 13; Privacy Protection (Conditions for Inspection of Information and Procedure for Appeal) Regulations, 5741-1981 · secondary source · source ↗
Uncertain. The regulation number and day count could not be confirmed from the regulations themselves, and some practitioners cite 21 days for inspection. The 30-day appeal period for direct mail is in s. 17F(e).
Marketing
2
Prior written or electronic opt-in for commercial electronic messages, with a narrow existing-customer exception; the PPL also gives an absolute right to opt out of direct mail.Communications (Telecommunications and Broadcasting) Law, 5742-1982, s. 30A; PPL s. 17F · secondary source · source ↗
Governance
DPO required
1
Required for public bodies, data brokers and direct mailers above 10,000 people, and entities whose core activity is systematic monitoring or large-scale special-sensitivity data.s. 17B1 · secondary source · source ↗
Banks, insurers, hospitals and health funds are named explicitly. A separate information security officer is still required under s. 17B for some entities.
DPO qualifications
1
The DPO needs in-depth knowledge of privacy law, an understanding of technology and information security, and no conflicting roles. The DPO reports to the CEO.ss. 17B2-17B3 · secondary source · source ↗
Registration
1
Registration only for public-body databases and databases of 10,000+ people mainly used to transfer data for payment; notify the PPA of special-sensitivity databases above 100,000 people.s. 8A(a)(1)-(2), 8A(b) · secondary source · source ↗
Before Amendment 13, registration was broad, covering 10,000+ subjects, sensitive data or direct marketing. The notification is due within 30 days of meeting the threshold.
DPIA
1
No general DPIA duty; the PPA recommends assessments, and high-security databases need periodic risk assessments and penetration tests.Data Security Regulations 5777-2017 (high-security tier); PPA guidance · secondary source · source ↗
The specific regulation number for risk assessments was not confirmed. The DPO's duties include overseeing risk assessments.
Records
2
Every database needs a database definition document (purposes, data types, transfers, processors) and written security procedures.Data Security Regulations 5777-2017, Reg. 2 · secondary source · source ↗
Chambers confirms the duty but not the regulation number; Reg. 2 comes from knowledge of the regulations.
Retention
1
Delete data once its lawful purpose is exhausted and review holdings periodically, at least annually, for excess data; no statutory periods.PPA Data Minimization Policy (25 Mar 2021); Data Security Regulations 5777-2017 · secondary source · source ↗
The duty rests on PPA policy and the security regulations, not a PPL section.
Breaches
Tell the regulator
3
Report a severe security incident to the PPA immediately on discovery, through its online form.Data Security Regulations 5777-2017, Reg. 11; PPA guidance of 7 Aug 2022 (amended 1 Sept 2025) · secondary source · source ↗
Only 'severe' incidents are reportable, and what counts as severe depends on the database's security tier.
Tell people
1
Notify affected individuals only if the PPA instructs it.Data Security Regulations 5777-2017, Reg. 11 · secondary source · source ↗
Transfers
Transfers abroad
2
Allowed only if the destination's protection is no lower than Israel's, or under listed exceptions such as consent, EU-adequate or Convention 108 countries, group or contractual safeguards; no PPA approval.Transfer of Data to Databases Abroad Regulations 5761-2001, Regs. 1-3 · secondary source · source ↗
A written undertaking from the recipient is required, and onward transfers are restricted. Separate regulations (5783-2023) govern data received from the EEA.
Localization
1
No general localization; sector rules (e.g., Bank of Israel Directives 362 and 364) restrict offshoring of banking data.No PPL provision; Bank of Israel Proper Conduct of Banking Business Directives 362, 364 · secondary source · source ↗
Enforcement
Maximum fine
3
Tiered administrative fines, many per data subject (e.g., ILS 4-8 per person for sensitive databases), plus fixed amounts up to ILS 640,000 per violation; no overall cap stated.s. 23Z and Appendix; s. 23AC (5% of turnover reference); s. 23AD (doubling for repeats) · secondary source · source ↗
Scored 3 because per-person fines on databases with millions of records can exceed USD 5m. Daily fines of 1% apply to continuing violations. The source does not fully explain how the 5%-of-turnover mechanism works. Transliterated section letters follow the source.
Criminal liability
2
Privacy infringement and breach of confidentiality carry up to 5 years in prison; Amendment 13 added offenses such as obstructing or misleading the PPA (6 months to 3 years).s. 5; s. 16; ss. 23BA-23BD · secondary source · source ↗
Amendment 13 removed the old strict-liability offenses (s. 31A).
Private action
3
Civil tort claims plus statutory damages without proof of harm: up to ILS 10,000 for listed database violations, more for privacy infringement. Class actions are available.s. 4; s. 15A (Amendment 13); s. 29A; Class Actions Law 5766-2006 · secondary source · source ↗
The s. 29A cap is uncertain: Chambers 2026 says up to ILS 100,000, which is commonly understood as ILS 50,000, doubled where there was intent to harm. The limitation period is now 7 years for claims arising after 14 Aug 2025.
Scores are our reading on the published rubric, checked 18 October 2026. Not legal advice.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.
- In force
- Coming into force
- Sector laws