Processes personal data, in Israel

Data Security Regulations, 5777-2017 (Privacy Protection), Regs. 10 and 17(a) · Read the law's page

• If you control a database subject to a medium or high security level, operate an automatic recording mechanism that monitors access to the database systems and records the user identity, the date and time of each access attempt, the system component, the access type, its scope, and whether access was granted or denied (Regulation 10(a)).
• Make the monitoring mechanism, to the extent possible, resistant to being disabled or modified, and have it detect any such modification or disabling and alert those responsible (Regulation 10(b)).
• Prescribe a routine procedure to examine the records of the monitoring mechanism and prepare a report of the issues found and the measures taken (Regulation 10(c)).
• Retain the records of the monitoring mechanism for at least 24 months, and keep the data collected under the listed regulations in a secure manner for 24 months (Regulations 10(d) and 17(a)).
• Inform the database's authorized users of the monitoring mechanism (Regulation 10(e)).

Privacy Protection Regulations (Data Security), 5777-2017, Art. 11(d)(1); Protection of Privacy Law, 5741-1981, monetary sanctions schedule item (21) · Read the law's page

• If you are a database controller, database manager or database processor and a severe security incident occurs, immediately notify the Registrar and report to the Registrar on the measures taken (Art. 11(d)(1), as extended by Art. 19(a)).

Privacy Protection Regulations (Data Security), 5777-2017, Regs. 1-10, 11(a)-(c), 12-20, 22; Protection of Privacy Law, 5741-1981, Art. 23KF and Third Schedule (enforcement) · Read the law's page

• An app operating a database of the personal data of a person in Israel, above the small-collection thresholds already recorded on this jurisdiction's privacy-topic row, must prescribe a written data security procedure covering physical protection, access authorizations, identification and authentication, encryption, and incident handling, scaled to the security-level tier (basic, medium, or high) that the volume and sensitivity of the data it holds places it in.
• At the medium or high tier, run an automatic mechanism monitoring access to the database's systems, retained at least 24 months, and appoint a data security officer where required.
• At the high tier, conduct a data security risk assessment and a penetration test of the database's systems at least once every 18 months, and hold a quarterly internal discussion of security incidents.
• At the medium or high tier, conduct an internal or external audit of compliance with these Regulations at least once every 24 months.
• Where an external service provider is given access to the database, agree in writing on the data and systems it may access, its reporting and data-destruction duties, and monitor its compliance.

Protection of Privacy Law, 5741-1981, as amended by Amendment No. 13, 5784-2024, Arts. 1-2, 4, 7-8A · Read the law's page

• An app that operates a database of the personal data of individuals in Israel above the small-collection thresholds must register with, or separately notify, the Privacy Protection Authority under Art. 8A, and must name a Data Protection Officer where the Act requires one.

Protection of Privacy Law, 5741-1981, as amended by Amendment No. 13, Art. 3 (biometric identifier and data of special sensitivity definitions), security-level provisions · Read the law's page

• An app that captures or stores a facial image, voiceprint, or other biometric identifier of a person in Israel, including one derived from a photo, video, or audio recording, must treat it as data of special sensitivity and apply Israel's tiered security-level obligations, which scale up automatically at 100,000 or more biometric identifiers held.

Protection of Privacy Law, 5741-1981, as amended by Amendment No. 13, Arts. 15A, 17B1-17B3, 29A, 31B, Chapters D3-D4 · Read the law's page

• An app processing the personal data of a person in Israel must be prepared to answer to the Privacy Protection Authority's monetary sanctions, and an individual harmed by a privacy infringement may bring a civil claim for statutory or exemplary damages without needing to prove actual damage.

Privacy Protection (Transfer of Data to Databases Abroad) Regulations, 5761-2001 · Read the law's page

• An app transferring the personal data of a person in Israel to a recipient outside Israel must rely on the destination providing protection no less than Israeli law's, or on one of the regulation's eight alternative grounds, most commonly consent, a common-control guarantee, an inter-party agreement, or an authority-gazetted adequate jurisdiction, and must obtain a written guarantee from the recipient in every case.

Protection of Privacy Law, 5741-1981, Arts. 13, 13A, 14 · Read the law's page

• An app holding the personal data of a person in Israel in a database must give that person a way to access their own data, and must act on a request to rectify or delete it, notifying any prior recipient of the correction or deletion.