Israel Protection of Privacy Law — 5741-1981

Why does it matter?

The Law protects privacy in two ways. Chapter A lists in section 2 what infringes privacy, for example spying on or trailing a person, using a person's name, picture or voice for profit, and using or passing on information on a person's private affairs for a purpose other than the one for which it was given, and makes infringement a civil wrong (section 4) and an offense (section 5). Chapter B regulates databases: lawful purpose, registration or notification, notice, access, rectification, security and officers. Courts can award damages without proof of loss, and the Head of the Authority can impose monetary sanctions.

Key benefits include:

• Defined terms that set the scope

Section 3 defines personal data, data of special sensitivity, database, processing, controller and processor.

• Registration only where it matters

Section 8A requires registration for data-broker databases above 10,000 individuals and for public bodies, and notification above 100,000 individuals with special-sensitivity data.

• Named security duties

Section 17 makes controller and processor each responsible for data security, and the 2017 Regulations set the measures by security level.

• A privacy officer with standing

Section 17B1 requires a data protection officer in public bodies, data brokers and large-scale monitoring or special-sensitivity processors, reporting to the general manager (17B2(c)).

• Rights for individuals

Section 11 requires a notice with each request for data, section 13 gives a right of access and section 14 a right to rectification.

How does it work?

Section 8 sets the base rule. No person may process personal data in a database except for the lawfully established purpose of the database (8(b)) or without the controller's authorization (8(c)), and a controller may not process data that was collected in violation of the Law or another law (8(d)). Under section 11 a request for personal data carries a notice that says whether the person must provide it, the purpose, the controller's name and contact details, who receives the data and the rights of access and rectification.

Section 8A sets registration and notification. A database must be registered if its main purpose is collecting personal data to give to another as a business practice or for consideration, including direct mailing, and it holds data on more than 10,000 individuals, or if its controller is a public body (unless it holds only employee data). Under 8A(b), a controller of an unregistered database that holds special-sensitivity data on more than 100,000 individuals notifies the Authority within 30 days, with the officer's details and a database definitions document.

Security follows the database. Section 17 makes the controller and the processor each responsible for data security. The Data Security Regulations, 5777-2017, require a database definitions document (regulation 2), a written security procedure (4), access control (8), access logging at the medium and high levels (10) and an audit at least every 24 months at those levels (16(a)). After a severe security incident the controller must immediately notify the Registrar (11(d)).

Key Elements

• Personal data and special sensitivity (section 3)

Twelve categories of special sensitivity include health, genetic and biometric data, criminal records, political or religious views and data on salary and financial activity.

• Registration and notification (section 8A)

Registration for data-broker databases above 10,000 individuals and for public bodies; notification above 100,000 individuals with special-sensitivity data.

• Data protection officer (sections 17B1 to 17B3)

Required for public bodies, data brokers, regular and systematic monitoring on a significant scale and core processing of special-sensitivity data; the officer may be a non-employee and must avoid conflicts of interest.

• Data security (section 17 and the 2017 Regulations)

Basic, medium and high security levels decide the measures a controller applies, with incident documentation and Registrar notice for severe incidents.

• Individual rights (sections 11, 13 and 14)

A notice with every request for data, a right of access and a right to rectification.

• Remedies and sanctions (sections 15A, 23KF and 29A)

Exemplary damages up to NIS 10,000 for specified database violations, statutory damages up to NIS 50,000 for an infringement (double if intended to harm) and monetary sanctions set by the Head of the Authority.

What does it cover?

The Law covers privacy infringements by any person (Chapter A) and databases of personal data (Chapter B). Section 3 defines a database as a collection of personal data processed by digital means, excluding a collection for personal use that is not for business purposes and a collection of only names, addresses and contact details of 100,000 individuals or fewer that reveals nothing more about them. Chapter D governs data that public bodies provide, and Chapter D2 sets a separate supervision regime for security agencies. For several provisions, including the right of access in section 13, "person" excludes a corporation.

What are its objectives?

The Law has no purposes clause; its provisions require the following outcomes.

Protect people against the infringements of privacy listed in section 2.

Keep personal data in databases lawful, tied to a purpose and secure (sections 8 and 17).

Give individuals notice, access and rectification (sections 11, 13 and 14).

Put accountable officers in place where databases are public, commercial, monitored or sensitive (sections 17B and 17B1).

Back the duties with oversight, cease orders and monetary sanctions imposed by the Head of the Authority (Chapter D3) and with civil damages (sections 15A and 29A).

Framework in Context

The Law rests on the Privacy Protection Regulations (Data Security), 5777-2017, published on May 8, 2017 and in force one year later (regulation 22), and on the Privacy Protection Regulations (Instructions for Data that was Transferred to Israel from the European Economic Area), 5783-2023, published on May 7, 2023. The European Commission's Decision 2011/61/EU of January 31, 2011 found Israel adequate; its report of January 15, 2024 confirmed that finding and recommended writing protections that exist in sub-legislative rules and case law into legislation. The PPA issues guidance, including Guidance No. 1/2024 on the role of the board under the Data Security Regulations and an opinion of July 14, 2026 on appointing a privacy protection officer.

Common Framework Mappings

Organizations map the Law to the privacy and security frameworks below. The European Commission's adequacy decision links it to the EU data protection regime, and the other mappings are made by the adopting organization.

Mapped frameworks include:

APEC PF

CCPA/CPRA

GDPR

HIPAA

ISO 27001:2022

ISO 27701

NIST Privacy Framework v1.0

OECD Privacy Guidelines