Protection of Privacy Law, enforcement, DPO duty and private rights of action

Criminal exposureYes

Private right of actionYes

Criminal exposure note

A person who willfully infringes another's privacy in any of the ways listed in Art. 2(1), (3) to (7), and (9) to (11) is liable to imprisonment for up to five years under Art. 5, the same maximum that applies to breaching the Act's confidentiality duty under Art. 16. Separate administrative-enforcement offenses in Chapter D4 carry shorter terms: up to six months for obstructing the Head of the Authority, an investigator, or an inspector; up to two years for misleading them; and up to three years each for processing personal data from a database without authorization, providing incorrect information when requesting data, or an unlawful data transfer from a public body.

Penalty structure

Art. 23KF sets several distinct tiers rather than one ceiling. Registration and notification violations carry a base 150,000 NIS sanction, doubled to 300,000 NIS where the database holds 1,000,000 or more individuals' data. Obstructing an inspector's document request carries a flat 300,000 NIS sanction. Violations of the Data Security Regulations are sanctioned per the Third Schedule's table, which varies by the database's security tier (individual-managed, basic, medium, or high) and reaches 320,000 NIS at the high tier, doubled to 640,000 NIS where that high-security database also holds 1,000,000 or more individuals. The most severe general violations under Art. 23KF(e), including unauthorized processing, processing for an unlawful purpose, and failing to comply with a cessation order, are sanctioned per affected individual at 4 NIS, or 8 NIS where the data is of special sensitivity, with a 200,000 NIS floor and no stated ceiling, so exposure for these violations scales with the size of the affected population rather than stopping at a fixed sum. A continuing violation adds 1 percent of the sanction per day it continues, and a repeated violation within 2 years adds a further full sanction amount, under Art. 23L.

Rule

Per violation only

As of

2 September 2026

Minimum

200,000

Currency

ILS

Per violation unit

Person

Per violation amount

8

Statutory damages

Art. 29A(b) lets a court award a civil plaintiff statutory damages up to 50,000 NIS per infringement of privacy under Art. 4, doubled to 100,000 NIS where intent to cause harm is proven, without the plaintiff proving actual damage. A person cannot recover statutory damages under Art. 29A more than once for the same infringement, and the amounts are indexed monthly to the change in Israel's consumer price index. Art. 29A(a) separately lets a court order the same 50,000 NIS civil payment following a criminal conviction under Art. 5. A narrower, independent mechanism sits at Art. 15A: exemplary damages up to 10,000 NIS for six enumerated database-controller procedural violations, mainly registration and access-related failures, where the court is directed to award them without regard to the extent of damage caused, and no more than once for the same act or omission. Whether a class action is available for either mechanism is not addressed in the Act's own text.

As of

2 September 2026

Currency

ILS

Per person reckless

100,000

Per person negligent

50,000

Enforcement body

Privacy Protection Authority (Head of the Authority), a unit of Israel's Ministry of Justice

Settledness

As of

20 October 2026

Guidance link

https://www.gov.il/BlobFolder/reports/guide_tikon13_professional/he/tikun%2013%20_170825.pdf

Guidance body

Privacy Protection Authority (Israel Ministry of Justice)

Open questions

Does 'on a significant scale' in Article 17B1(a)(4) of the Protection of Privacy Law, which Article 17B1(b) judges by the number of individuals about whom data is processed and their proportion in a specific population, reach an app that holds data of special sensitivity about a small share of a population as part of its main activity?

Obligation class

Governance

Applicability criteria

These are the entities Article 17B1 requires to appoint a data protection officer; Article 17B1(b) lists the factors that make a scale significant.

As of

30 October 2026

Combinator

Any of

Criteria

• The database controller is a public body as defined in Article 23, or a processor of such a database, other than a security body as defined in Article 23K (Article 17B1(a)(1)).
• The main purpose of the database controller is to collect personal data for providing it to another as a business practice or for consideration, and the database contains personal data about more than 10,000 individuals (Article 17B1(a)(2)).
• The core activities of the database controller or processor involve processing that, given its nature, scope or purpose, requires regular and systematic monitoring of individuals on a significant scale (Article 17B1(a)(3)).
• The main activity of the database controller or processor includes processing data of special sensitivity on a significant scale (Article 17B1(a)(4)).

Log retention

The 12-month floor is the sanctions schedule's own figure for the access-monitoring records (item 18(c)); item 25 says the data collected under the documentation rules is kept for at least one year. The official English translation of the Data Security Regulations says 24 months in Regulations 10(d) and 17(a), so the Regulations may set a longer period than the Act's schedule states.

Unit

Months

As of

28 October 2026

Basis

Fixed

Minimum value

12

Logging duty

This row's Chapters D3 and D4 and Articles 15A, 17B1 to 17B3, 29A and 31B set the enforcement, the data protection officer and the civil claims. The monetary-sanctions schedule in Chapter D3 fines a database controller or processor that has not kept the records the Data Security Regulations require: it has not ensured a monitoring mechanism for access and kept its records for at least 12 months (item 18), has not ensured the documentation of security incidents (item 19), has not retained the documentation data for at least one year (item 25), or has not documented how it performed an action the Regulations require (item 27). The schedule fines the failure and the duties themselves are in the Regulations, whose contents are not set out in the Act, so the Act does not set out the log contents. Item 29 fines a database that has not had an internal or external audit at least every 24 months, and item 20 fines a database that has not held and documented a periodic discussion of security incidents. Article 17B2(a)(2) also requires the data protection officer to prepare a program of continuous monitoring of compliance. The Act's text carries no access right for the Authority to these records outside the investigators' powers of Chapter D4, which work through court orders for search and seizure. The cited provisions state no territorial hook.

Kind

Explicit

As of

28 October 2026

Provision

Chapter D3, monetary-sanctions schedule items (18), (19), (25) and (27) (the access-monitoring records, the security-incident documentation and the documentation required by the Data Security Regulations), with items (20) and (29) and Article 17B2(a)(2)

Trigger

• personal_data_processing
• security_incident