IsraelPrivacy Protection (Transfer of Data to Databases Abroad) Regulations, cross-border transfer
Privacy Protection (Transfer of Data to Databases Abroad) Regulations, 5761-2001
In force.
A cross border transfer rule binding public and private bodies.
- Audit expectation
- none
What it requires
- An app transferring the personal data of a person in Israel to a recipient outside Israel must rely on the destination providing protection no less than Israeli law's, or on one of the regulation's eight alternative grounds, most commonly consent, a common-control guarantee, an inter-party agreement, or an authority-gazetted adequate jurisdiction, and must obtain a written guarantee from the recipient in every case.
These lines are LexLint's reading of the law's text. Also read by: Privacy Protection Authority (Israel Ministry of Justice) (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- ID.DE-P3Contracts with data processing ecosystem parties are used to implement appropriate measures designed to meet the objectives of an organization’s privacy program.
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://www.gov.il/BlobFolder/legalinfo/infoabroad/he/infoabroad.pdf
- Guidance body
- Privacy Protection Authority (Israel Ministry of Justice)
- Open questions
- Which differences in the recipient's home law, beyond the absence of a database-registration duty, count as the changes 'mutatis mutandis' that Regulation 2(4) allows when a transfer relies on an agreement with the recipient?
What it makes you log
Logging duty
Regulation 1 bars a transfer abroad unless the destination law gives protection no lesser than Israeli law, Regulation 2 lists the grounds on which a transfer may go ahead without that, and Regulation 3 requires the database owner to obtain the recipient's written guarantee that it takes adequate privacy measures and passes the data to no one else. The guarantee is a condition of the transfer; the regulations do not tell the owner to keep a record, a log or evidence of it, and name no retention period or audit. Regulation 1 turns on data from databases in Israel, a test of where the database is, which has no hook value here.
- Kind
- None
- As of
What this law does
Under PPL Art. 36(2), these regulations bar transfer of personal data outside Israel unless the destination country's law ensures protection no less than Israeli law provides, subject to five baseline principles: fair collection, purpose limitation, accuracy, an inspection right, and security.
Regulation 2 lists eight independent grounds permitting transfer regardless of that default rule: consent; vital-interest necessity where consent cannot be obtained; transfer to a corporation under common control with a privacy guarantee; transfer to a party bound by agreement to the same conditions; data already made public or open for inspection; public safety or security necessity; a legally mandated transfer; or transfer to a Convention 108 party, a state receiving data from EU member states on equivalent terms, or a state the Registrar of Databases has gazetted as having an adequate privacy authority.
Regulation 3 requires a written guarantee from the recipient in every case. No data localization is compelled. Regulation 5 (the regulations' own commencement clause) provides that the regulations enter into force six months after the date of their publication; the regulations were signed (26 Sivan 5761). They were published in Kovetz HaTakanot 5761 at page 900, and no commencement day has been located. Whether Amendment 13 touched this 2001 regulation was not confirmed against the Reshumot.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .