IsraelPrivacy Protection Regulations (Data Security), access-monitoring records and their retention
Data Security Regulations, 5777-2017 (Privacy Protection), Regs. 10 and 17(a)
In force since .
A comprehensive regime rule binding public and private bodies.
- Obligation class
- Security, Retention
- Audit expectation
- periodic
- Who audits it
- Self
- Where the report goes
- Kept
As of .
What it requires
- If you control a database subject to a medium or high security level, operate an automatic recording mechanism that monitors access to the database systems and records the user identity, the date and time of each access attempt, the system component, the access type, its scope, and whether access was granted or denied (Regulation 10(a)).
- Make the monitoring mechanism, to the extent possible, resistant to being disabled or modified, and have it detect any such modification or disabling and alert those responsible (Regulation 10(b)).
- Prescribe a routine procedure to examine the records of the monitoring mechanism and prepare a report of the issues found and the measures taken (Regulation 10(c)).
- Retain the records of the monitoring mechanism for at least 24 months, and keep the data collected under the listed regulations in a secure manner for 24 months (Regulations 10(d) and 17(a)).
- Inform the database's authorized users of the monitoring mechanism (Regulation 10(e)).
These lines are LexLint's reading of the law's text, as of .
What it makes you log
What the log must hold
Event time, Actor identity, Access record, Integrity control
Log retention
Regulation 10(d): the records of the monitoring mechanism are retained for at least 24 months, and Regulation 17(a) keeps the data collected under the listed regulations for 24 months. The sanctions schedule's own words in the Protection of Privacy Law state 12 months (item 18(c)) and one year (item 25) for the same records, and the text states no maximum.
- Unit
- Months
- As of
- Basis
- Fixed
- Minimum value
- 24
Logging duty
Regulation 10(a) requires a database subject to a medium or high security level to have an automatic recording mechanism that monitors access to the database systems and records the user identity, the date and time of the access attempt, the system component accessed, the access type, its scope and whether access was granted or denied. Regulation 10(b) requires the mechanism, to the extent possible, to resist being disabled or modified and to alert those responsible to any such change, and Regulation 10(c) requires a routine procedure to examine its records and a report of the issues found and the measures taken, which is the controller's own review. Regulation 10(d) sets 24 months as the minimum retention for the records, and Regulation 17(a) sets 24 months for the data collected under Regulations 6(b), 8 to 11, 14, 15(a)(4) and 16. The sanctions schedule of the Protection of Privacy Law fines a failure to meet Regulation 10, and in its English translation item 18(c) states 12 months and item 25 states one year for the same records, so the two official English texts differ on the period; this row carries the period the Regulations themselves set. No regulator access to the records is stated in these Regulations. The Regulations state no territorial hook.
- Kind
- Explicit
- As of
- Provision
- Regulation 10(a) to (e) (the automatic access-monitoring mechanism, its integrity, the routine examination of its records and their retention), with Regulation 17(a) (retention of the security data)
- Trigger
- personal_data_processing
What this law does
Regulation 10(a) requires the system of a database subject to a medium or high security level to have an automatic recording mechanism that monitors access to the database systems, recording the user identity, the date and time of the access attempt, the system component to which access was attempted, the access type, its scope, and whether access was granted or denied.
Regulation 10(b) requires the monitoring mechanism, to the extent possible, not to allow its operation to be disabled or modified, and to detect any such modification or disabling and send alerts to those responsible. Under Regulation 10(c), the database controller prescribes a routine procedure to examine the records of the monitoring mechanism and prepare a report of the issues found and the measures taken.
Regulation 10(d) requires the records of the monitoring mechanism to be retained for at least 24 months. Regulation 17(a) requires a database controller to retain the data collected when implementing the listed regulations, which include Regulation 10, in a secure manner for 24 months. Item 18(c) of the monetary sanctions schedule in the Protection of Privacy Law states 12 months for the retention of the monitoring mechanism's records, in a clause that fines a failure to meet Regulation 10(d).
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach, processes biometric data or processes voice recordings.