🇮🇱Protection of Privacy Law, 5741-1981

← Back to laws in Israel

A privacy law updated for modern personal data processing

Israel's Privacy Protection Law, 5741-1981 keeps its original foundation: a person must not invade another person's privacy without consent. But the updated Law now contains a much more modern database and personal data governance regime. It uses concepts such as personal data, database controller, database holder, data of special sensitivity, processing authorisation, registration or notification obligations, privacy protection officers, administrative inquiries, monetary sanctions and judicial orders.

This structure matters. Israeli privacy compliance is not just a question of having a privacy policy. Organisations need to know what personal data they process in databases, whether they are controllers or holders, whether the processing matches the lawfully established purpose of the database, whether the data was collected lawfully, whether notice was given properly, whether the database must be registered or notified, and whether a privacy protection officer or data security officer is required.

Core definitions — personal data, controllers, holders and special sensitivity

The updated Law defines personal data as data relating to an identified or identifiable person. Identification may be direct or indirect and may involve identifiers such as name, identification number, biometric identifier, location data, online identifier or other details relating to physical, health, economic, social or cultural status.

A database is a collection of personal data processed by digital means, with limited exclusions for personal non-business use and certain narrow contact-only collections of 100,000 individuals or less that do not indicate additional personal data and are not linked with another collection containing other data details about the same individuals.

A database controller is the person or entity that determines, alone or with another, the purposes of processing the data in the database. A database holder is an external entity processing data on behalf of the controller. A database manager is the database controller, and for a public body, the general manager or authorised manager of the database.

Data of special sensitivity is a wide category. It includes intimate and family life, health data, genetic data, biometric identifiers, origin, criminal history, political opinions, religious beliefs or worldview, certain personality assessments, location and transmission data, payroll and financial activity, data subject to legal confidentiality, and certain data transferred to Israel from outside the country where special legal protection applies at source.

The privacy invasion rule remains the foundation

The Law continues to prohibit invading another person's privacy without consent. Consent means informed consent, whether explicit or implicit. A privacy invasion includes conduct such as spying or trailing in a harassing manner, prohibited eavesdropping, photographing a person in a private domain, publishing humiliating photographs, unauthorised copying or use of private correspondence, use of a person's name, photograph or voice for profit, breach of statutory or contractual confidentiality obligations, misuse of knowledge about private affairs, and publication of intimate, health or private-domain matters.

A privacy invasion is a civil wrong. Intentional invasion through specified forms is also a criminal offence punishable by up to five years' imprisonment. The Law excludes insignificant harm, but that exclusion should not be treated as a safe harbour for meaningful misuse of personal data, correspondence, photographs, health information, intimate information or private affairs.

Lawful processing in databases — purpose and authorisation

The updated database chapter now states the processing rule directly. Personal data in a database may be processed only for the lawfully established purpose of the database. Personal data from a database may not be processed without authorisation from the database controller or beyond the scope of that authorisation.

The Law also restricts processing where the personal data in the database was created, received, accumulated or collected in violation of the Law or another law regulating data processing. If data was provided by another entity and the controller did not and could not have known that the other entity acted unlawfully, the controller is protected for processing carried out before it knew or should have known of the issue. Minor violations are treated separately under the statutory wording.

Registration and notification — the old trigger logic has changed

The updated Law separates registration from notification. A database must be registered where its main purpose is collecting personal data for providing it to another as a business practice or for consideration, including direct mailing services, and it contains personal data about more than 10,000 individuals. Registration is also required for certain public body databases, unless the database includes only personal data about that public body's employees.

A controller may not process personal data in a database subject to registration, or permit another to process such data on its behalf, unless the database is registered. A database is treated as registered where the application has been submitted and the statutory period has passed without refusal or suspension. The Head of the Authority may exempt a database from registration if registration is not necessary to ensure compliance.

A separate notification obligation applies where a database is not subject to registration but contains data of special sensitivity about more than 100,000 individuals. In that case, the controller must notify the Authority within 30 days, provide controller contact details, privacy protection officer details where appointment is required, and provide a copy of the database definitions document required under the regulations. Changes and cessation of activity must also be notified within the prescribed timeline.

Databases containing only data that has been publicly published or made available to the public under lawful authority are excluded from the registration or notification section.

Registration application and Authority powers

A registration application must include the identity, Israeli address and contact details of the database controller, the identity and contact details of the privacy protection officer, the type of service provided by the holder to the controller, the purposes of establishing the database and the purposes for which the data is intended, the types of data included, details of transfers outside Israel, and details of regular receipt of data from public bodies except where received with the data subject's consent.

The Head of the Authority must register the database within the statutory period unless there are reasonable grounds to assume that the database is used or may be used for illegal activity or that the personal data was created, received, accumulated or collected unlawfully. The Head of the Authority may also register a different purpose, register multiple purposes or require separate registration as several databases where that better fits the actual activity of the database.

Notice at collection — section 11 now carries more information

When a person is asked to provide personal data for processing in a database, the request must be accompanied by a notice stating whether the person is legally required to provide the data or whether provision depends on will and consent, the consequence of non-consent, the purpose for which the data is requested, the name and contact details of the database controller, to whom the data will be delivered and for what purposes, and the existence of the right to review and request correction of personal data.

This is one of the most practical changes. Forms, onboarding screens, KYC flows, HR declarations, customer journeys, app permissions and lead-generation flows should be checked against the section 11 notice elements. The notice must be available at the point of requesting data, not merely hidden inside a general privacy policy.

Rights to review and correction

Every person is entitled to review personal data held about them in a database, personally, through an authorised representative or through a guardian. The controller must allow review in Hebrew, Arabic or English. Special rules apply where medical or mental-condition data may significantly harm the requester or endanger life, in which case the data may be provided to a physician or psychologist acting on the requester's behalf.

The Law also recognises review where the personal data is not physically held by the controller but by a holder. The controller must direct the requester to the holder and instruct the holder in writing to allow the review. If the requester approaches the holder first, the holder must say whether it holds personal data about the requester and identify the controller.

After review, a person may request correction or deletion where personal data is incorrect, incomplete, unclear or outdated. If the controller agrees, the necessary amendments must be made and recipients of the data must be notified within the period prescribed by regulations. If the controller refuses, the requester must be informed in the prescribed manner and may file a claim with the court.

Data security, data security officer and privacy protection officer

The database controller and database holder are each responsible for the security of the data in the database. The Law allows regulations on physical and logical protection, database procedures, work rules and restrictions on employee access.

Certain entities must appoint a data security officer, including a controller or holder of five databases under registration or notification obligations, a public body, and banks, insurance companies and credit rating or evaluation companies. The data security officer is responsible for securing data in the relevant databases and must meet the statutory suitability conditions.

The updated Law also introduces a privacy protection officer obligation for several categories of entities. These include public bodies and their holders, certain data businesses collecting personal data for delivery to others above the 10,000-individual threshold, controllers or holders whose main activities require continuous and systematic monitoring of individuals on a significant scale, and controllers or holders whose main occupation includes processing data of special sensitivity on a significant scale.

The privacy protection officer acts as a professional authority and knowledge centre, advises management and employees, prepares and supervises training, monitors compliance, reports findings to management, ensures data security procedures and database definition documents exist, handles individual requests concerning processing and rights, publishes accessible contact means, and serves as the contact point with the Authority. The officer must have adequate knowledge and skills, including privacy law, technology and data security understanding, and must not be placed in a conflict of interest.

Direct mailing

The direct-mailing framework continues, but should be read with the new controller-holder language. A controller or holder must not process personal data in a database used for direct mailing services unless the database is registered and one of its registered purposes is direct mailing services.

The controller or holder must keep records showing the source of each data collection used for the database, the date received and to whom each collection was delivered. Every direct mailing communication must clearly and prominently state that it is direct mailing, identify the database registration number, notify the recipient of the right to be deleted from the database, provide the address for deletion requests, and identify the controller and sources from which the controller received the personal data.

A person may demand deletion from a direct-mailing database and may also demand that personal data about them not be transferred to a person, class of persons or specific persons, for a limited or permanent period. The controller must comply and notify the person in writing. If no confirmation is given within 30 days, the person may apply to the Magistrates Court.

Public bodies and excessive personal data

The Law continues to restrict providing data by public bodies. The default rule is that a public body may not provide data unless a statutory route applies. The updated framework also includes obligations relating to requests by public bodies, regular receipt of personal data, and excessive personal data. Public bodies and organisations receiving public-body data should not treat inter-agency or public-to-private data sharing as a routine administrative transfer. It must be tied to a lawful route, purpose and documentation.

The Privacy Protection Authority and enforcement

The Head of the Privacy Protection Authority supervises compliance with the Law and regulations regarding databases. The Authority may publish procedures, issue preliminary opinions at the request of a controller, holder or prospective controller or holder, and report annually on its activities to the Constitution, Law and Justice Committee of the Knesset.

The updated Law contains detailed supervisory and administrative inquiry powers, including appointment of inspectors, inspector powers, administrative inquiry procedures, search and seizure orders and access to computer material. It also contains special arrangements for sectoral supervision, external experts, security agencies and pre-election periods.

Administrative enforcement now includes powers to order cessation of violations, monetary sanctions, administrative alerts, commitments and surety bonds, publication, appeal mechanisms, continued criminal liability and judicial orders. A court may issue an order to stop processing personal data or to delete personal data. The enforcement structure therefore moves the Law beyond a purely civil-criminal model into a regulatory enforcement model.

Remedies, damages and offences

The Law preserves civil and criminal exposure for privacy invasions. It also provides exemplary damages of up to 10,000 new shekels for specified database-related violations, including processing a registrable database while unregistered after demand and delay, failing to provide required notices after demand and delay, failure to allow review, failure to correct or delete after agreement, failure to notify refusal, and failure to notify regular receipt of public-body data after demand and delay.

Statutory damages may also be available for privacy invasion without proof of damage, including higher exposure where the invasion was committed with intent to cause harm. Material acquired through a privacy invasion is generally inadmissible as evidence unless the injured party consents, the court permits its use for recorded reasons, or the violator has a valid defence or exemption.

The Law also contains offences for interfering with the Head of the Authority, an investigator or supervisor; misleading the Head of the Authority, an inspector or external expert; processing data from a database without authorisation; providing incorrect information when requesting data; and unlawful data transfer from a public body.