IsraelPrivacy Protection Regulations (Data Security), information security programme
Privacy Protection Regulations (Data Security) 5777-2017, Regs. 1-10, 11(a)-(c), 12-20, 22; Protection of Privacy Law, 5741-1981, Art. 23KF and Third Schedule (enforcement)
In force since .
A security baseline statutes rule binding public and private bodies.
- Obligation class
- Security
What it requires
- An app operating a database of the personal data of a person in Israel, above the small-collection thresholds already recorded on this jurisdiction's privacy-topic row, must prescribe a written data security procedure covering physical protection, access authorizations, identification and authentication, encryption, and incident handling, scaled to the security-level tier (basic, medium, or high) that the volume and sensitivity of the data it holds places it in.NIST CSF 2.0GV.PO-01
- At the medium or high tier, run an automatic mechanism monitoring access to the database's systems, retained at least 24 months, and appoint a data security officer where required.NIST CSF 2.0PR.PS-04NIST CSF 2.0GV.RR-02
- At the high tier, conduct a data security risk assessment and a penetration test of the database's systems at least once every 18 months, and hold a quarterly internal discussion of security incidents.NIST CSF 2.0ID.RA-05NIST CSF 2.0ID.IM-02
- At the medium or high tier, conduct an internal or external audit of compliance with these Regulations at least once every 24 months.NIST CSF 2.0ID.IM-01
- Where an external service provider is given access to the database, agree in writing on the data and systems it may access, its reporting and data-destruction duties, and monitor its compliance.NIST CSF 2.0GV.SC-05NIST CSF 2.0GV.SC-07
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- ID.DE-P3Contracts with data processing ecosystem parties are used to implement appropriate measures designed to meet the objectives of an organization’s privacy program.
- ID.DE-P5Data processing ecosystem parties are routinely assessed using audits, test results, or other forms of evaluations to confirm they are meeting their contractual, interoperability framework, or other obligations.
- GV.MT-P3Policies, processes, and procedures for assessing compliance with legal requirements and privacy policies are established and in place.
- CT.DM-P8Audit/log records are determined, documented, implemented, and reviewed in accordance with policy and incorporating the principle of data minimization.
- PR.PO-P7Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are established, in place, and managed.
- PR.PO-P10A vulnerability management plan is developed and implemented.
- NIST CSF 2.0
- GV.RR-02Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced
- GV.PO-01Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced
- GV.SC-05Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties
- GV.SC-07The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship
- ID.RA-05Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk and inform risk response prioritization
- ID.IM-01Improvements are identified from evaluations
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
The Third Schedule's monetary sanctions are administrative, imposed by the Head of the Authority under Article 23KF of the Protection of Privacy Law. No criminal offense specific to a bare failure of these security-programme duties, as distinct from an actual privacy infringement under Article 5, was found in either instrument read for this row.
Penalty structure
The Protection of Privacy Law's Third Schedule (Art. 23KF(h)) sets a distinct monetary sanction for each of 29 numbered categories of violation of the Data Security Regulations, in four columns keyed to the database's security tier (individually-managed, basic, medium, high). Amounts observed across the schedule's safeguards violations (excluding item (21), the Regulation 11(d) breach-notification duty already filed as this jurisdiction's privacy row) range from 1,000 NIS, for a basic-tier or individually-managed database's failure of the physical-protection duty under Regulation 6(a), up to 320,000 NIS at the high tier, for example a high-tier database controller's failure to monitor and supervise an external service provider's compliance under Regulation 15(a)(4). Most other numbered violations sit at 2,000 NIS (individual or basic tier) rising to 40,000 NIS (medium tier) and 160,000 NIS (high tier). Article 2(a) to (d) of the Law separately scales the sanction down for a micro- or small-enterprise violator.
- Rule
- Fixed only
- As of
- Minimum
- 1,000
- Currency
- ILS
- Fixed cap
- 320,000
Who enforces it
Enforcement body
Privacy Protection Authority (Head of the Authority), a unit of Israel's Ministry of Justice, acting as Registrar under the Protection of Privacy Law.
What this law does
Every database controller in Israel, private or public, must prescribe a written data security procedure covering physical protection, access authorizations, identification and authentication, encryption of stored and transmitted data, and incident handling, scaled to one of four security-level tiers (individually-managed, basic, medium, high) set by the type, volume, and sensitivity of data the database holds.
A database controller subject to the medium or high tier must additionally run an automatic access-monitoring mechanism retained at least 24 months, and a controller subject to the high tier must conduct a data security risk assessment and a penetration test at least once every 18 months.
Every controller other than one managing a database individually must appoint a data security officer where the Protection of Privacy Law requires one, and must conduct an internal or external audit of compliance with these Regulations at least once every 24 months for a medium- or high-tier database.
A controller engaging an external service provider with access to the database must agree in writing on the data the provider may process, the systems it may access, and the provider's own reporting and destruction duties, and must monitor the provider's compliance.
The Registrar (Head of the Privacy Protection Authority) may exempt a specific database from these duties, or extend them to one that would not otherwise be covered, by written notice given the database's size, the type of information it holds, and its number of authorized users. These duties are separate from Regulation 11(d)'s duty to notify the Registrar of a severe security incident, which is this jurisdiction's privacy-topic breach-notification row.
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings, processes biometric data, processes personal data, serves under-18s, operates a social platform, ships a mobile app, distributes a software product, generates content with AI, publishes adult content, operates an app store, reuses other publishers' content, records calls, records text chat or tracks devices.
Back to the example · Lint your app
Page updated .