Privacy Protection Law
Protection of Privacy Law, 5741-1981 (as amended by Amendment 13)
Israel's Protection of Privacy Law, 5741-1981, is the country's foundational privacy and data protection statute, governing databases and personal information. Amendment 13, which took effect in August 2025, comprehensively modernized the law by broadening definitions, mandating privacy protection officers in certain cases, and sharply expanding the Privacy Protection Authority's enforcement and sanctioning powers.
Who it applies to
Public bodies and private organizations that own, hold, or manage databases of personal information about individuals in Israel.
Identity requirements
- Process personal data on a lawful basis with informed consent and provide enhanced transparency to data subjects
- Appoint a Privacy Protection Officer for public bodies, data brokers, large-scale sensitive-data processors, and those conducting systematic monitoring
- Notify the Privacy Protection Authority of databases containing sensitive information on more than 100,000 individuals
- Uphold data subject rights including access and correction of personal information
- Implement information security measures under the Privacy Protection (Data Security) Regulations
- Apply heightened controls to the broadened category of sensitive data
How it impacts identity systems
| Identity area | Impact |
|---|---|
| Identity governance (IGA) | Organizations must define and register databases and appoint accountable privacy officers to govern access to personal data. |
| Customer identity & consent (CIAM) | Processing requires informed consent and enhanced transparency toward individuals. |
| Audit, logging & accountability | Data security regulations require access logging, controls, and documented accountability over databases. |
| Authentication & MFA | The data security regulations mandate access controls and authentication safeguards for systems holding personal data. |
| Identity verification (KYC/proofing) | The expanded definition of sensitive data subjects identity and biometric information to stricter protection. |
Penalties
Amendment 13 empowers the PPA to impose substantial administrative monetary penalties reaching millions of shekels, with higher amounts for large databases or sensitive information, alongside cease-and-desist and other enforcement orders.
Privacy Protection Law: frequently asked questions
- What is Israel's main data protection law?
- The Protection of Privacy Law, 5741-1981, as significantly amended by Amendment 13, which took effect in August 2025.
- What did Amendment 13 change?
- It broadened key definitions, required privacy protection officers in defined cases, strengthened transparency and data-broker rules, and greatly expanded the PPA's enforcement and penalty powers.
- Who enforces privacy law in Israel?
- The Privacy Protection Authority (PPA), part of the Ministry of Justice, supervises and enforces the law.