IsraelProtection of Privacy Law, breach notification duty
Privacy Protection Regulations (Data Security) 5777-2017, Art. 11(d)(1); Protection of Privacy Law, 5741-1981, monetary sanctions schedule item (21)
In force since .
A breach notification rule binding public and private bodies.
- Audit expectation
- periodic
- Who audits it
- Self
What it requires
- If you are a database controller, database manager or database processor and a severe security incident occurs, immediately notify the Registrar and report to the Registrar on the measures taken (Art. 11(d)(1), as extended by Art. 19(a)).
These lines are LexLint's reading of the law's text. Also read by: Privacy Protection Authority (Israel Ministry of Justice) (guidance, recorded ).
Who enforces it
Settledness
- As of
- Guidance link
- https://www.gov.il/BlobFolder/guide/data_security_guide/he/NEW_GUIDE.pdf
- Guidance body
- Privacy Protection Authority (Israel Ministry of Justice)
- Open questions
- Does an incident affecting a database subject to the basic security level, which neither paragraph (1) nor paragraph (2) of the definition of 'Severe security incident' in Regulation 1 of the Data Security Regulations covers, carry any duty to notify the Registrar under Regulation 11(d)(1)?
What it makes you log
Logging duty
Regulation 11(a) makes the database controller responsible for documenting every event raising concern about a breach of data integrity, unauthorized use or deviation from authorization, based as far as possible on automatic records, and Regulation 19(a) extends that to the database manager and processor. This row cites Regulation 11(d)(1), the duty to notify the Registrar of a severe security incident and report the measures taken, which is a notification and not a record; the documentation duty in paragraph (a) is in the same regulation and is what the row records. Regulation 11(c) requires the controller to discuss security incidents at least once a year for a medium security level database and at least quarterly for a high one, and to assess whether the security procedure needs updating, which is the controller's own review on a fixed clock. The access-monitoring log in Regulation 10, and the retention rule for the security data in Regulation 17(a), are separate provisions of the Regulations. The regulations state no territorial hook.
- Kind
- Explicit
- As of
- Provision
- Regulation 11(a) (documentation of every security incident, based as much as possible on automatic records), with Regulation 11(c) (periodic discussion of incidents)
- Trigger
- security_incident
What this law does
The Privacy Protection Regulations (Data Security), 5777-2017 are confirmed at primary source.
Regulation 11(d)(1) requires a database controller to immediately notify the Registrar (Head of the Privacy Protection Authority) of a severe security incident and report on the measures taken in response; this confirms and replaces the main Act's cross-referenced monetary-sanctions-schedule item (21), which separately fines a controller or processor who fails that duty at up to 80,000 or 320,000 NIS for an individual or corporate violator.
A severe security incident is defined by Regulation 1 by reference to the database's security-level tier (unauthorized use or integrity damage affecting a high-security database, or a substantial part of a medium-security one).
Regulation 22 (the regulations' own commencement clause) provides that the regulations take effect one year after their publication; the regulations' own text carries a footnote citing publication as Reshumot Regulations File 5777 no. 7809 dated , so the one-year clock runs from that date to . The Minister of Justice signed the regulations . Any data-subject notification duty distinct from the Registrar-notification duty was not independently confirmed.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .