Privacy Protection (Transfer of Data to Databases Abroad) Regulations, cross-border transfer

Under PPL Art. 36(2), these regulations bar transfer of personal data outside Israel unless the destination country's law ensures protection no less than Israeli law provides, subject to five baseline principles: fair collection, purpose limitation, accuracy, an inspection right, and security.

Regulation 2 lists eight independent grounds permitting transfer regardless of that default rule: consent; vital-interest necessity where consent cannot be obtained; transfer to a corporation under common control with a privacy guarantee; transfer to a party bound by agreement to the same conditions; data already made public or open for inspection; public safety or security necessity; a legally mandated transfer; or transfer to a Convention 108 party, a state receiving data from EU member states on equivalent terms, or a state the Registrar of Databases has gazetted as having an adequate privacy authority.

Regulation 3 requires a written guarantee from the recipient in every case. No data localization is compelled.

Regulation 5 (the regulations' own commencement clause) provides that the regulations enter into force six months after the date of their publication; the regulations were signed 17 June 2001 (26 Sivan 5761), but their Reshumot publication date, which Regulation 5's six-month clock actually runs from, was not established at primary source, so no effective date is recorded, rather than one computed from the signature date. Whether Amendment 13 touched this 2001 regulation was not confirmed against the Reshumot.