Serves under-18s, in Israel

Privacy Protection Regulations (Data Security), 5777-2017, Regs. 1-10, 11(a)-(c), 12-20, 22; Protection of Privacy Law, 5741-1981, Art. 23KF and Third Schedule (enforcement) · Read the law's page

• An app operating a database of the personal data of a person in Israel, above the small-collection thresholds already recorded on this jurisdiction's privacy-topic row, must prescribe a written data security procedure covering physical protection, access authorizations, identification and authentication, encryption, and incident handling, scaled to the security-level tier (basic, medium, or high) that the volume and sensitivity of the data it holds places it in.
• At the medium or high tier, run an automatic mechanism monitoring access to the database's systems, retained at least 24 months, and appoint a data security officer where required.
• At the high tier, conduct a data security risk assessment and a penetration test of the database's systems at least once every 18 months, and hold a quarterly internal discussion of security incidents.
• At the medium or high tier, conduct an internal or external audit of compliance with these Regulations at least once every 24 months.
• Where an external service provider is given access to the database, agree in writing on the data and systems it may access, its reporting and data-destruction duties, and monitor its compliance.