Protection of Privacy Law, enforcement, DPO duty and private rights of action

Criminal exposureYes

Private right of actionYes

Criminal exposure note

A person who willfully infringes another's privacy in any of the ways listed in Art. 2(1), (3) to (7), and (9) to (11) is liable to imprisonment for up to five years under Art. 5, the same maximum that applies to breaching the Act's confidentiality duty under Art. 16. Separate administrative-enforcement offenses in Chapter D4 carry shorter terms: up to six months for obstructing the Head of the Authority, an investigator, or an inspector; up to two years for misleading them; and up to three years each for processing personal data from a database without authorization, providing incorrect information when requesting data, or an unlawful data transfer from a public body.

Penalty structure

Art. 23KF sets several distinct tiers rather than one ceiling. Registration and notification violations carry a base 150,000 NIS sanction, doubled to 300,000 NIS where the database holds 1,000,000 or more individuals' data. Obstructing an inspector's document request carries a flat 300,000 NIS sanction. Violations of the Data Security Regulations are sanctioned per the Third Schedule's table, which varies by the database's security tier (individual-managed, basic, medium, or high) and reaches 320,000 NIS at the high tier, doubled to 640,000 NIS where that high-security database also holds 1,000,000 or more individuals. The most severe general violations under Art. 23KF(e), including unauthorized processing, processing for an unlawful purpose, and failing to comply with a cessation order, are sanctioned per affected individual at 4 NIS, or 8 NIS where the data is of special sensitivity, with a 200,000 NIS floor and no stated ceiling, so exposure for these violations scales with the size of the affected population rather than stopping at a fixed sum. A continuing violation adds 1 percent of the sanction per day it continues, and a repeated violation within 2 years adds a further full sanction amount, under Art. 23L.

Rule

Per violation only

As of

2 September 2026

Minimum

200,000

Currency

ILS

Per violation unit

Person

Per violation amount

8

Statutory damages

Art. 29A(b) lets a court award a civil plaintiff statutory damages up to 50,000 NIS per infringement of privacy under Art. 4, doubled to 100,000 NIS where intent to cause harm is proven, without the plaintiff proving actual damage. A person cannot recover statutory damages under Art. 29A more than once for the same infringement, and the amounts are indexed monthly to the change in Israel's consumer price index. Art. 29A(a) separately lets a court order the same 50,000 NIS civil payment following a criminal conviction under Art. 5. A narrower, independent mechanism sits at Art. 15A: exemplary damages up to 10,000 NIS for six enumerated database-controller procedural violations, mainly registration and access-related failures, where the court is directed to award them without regard to the extent of damage caused, and no more than once for the same act or omission. Whether a class action is available for either mechanism is not addressed in the Act's own text.

As of

2 September 2026

Currency

ILS

Per person reckless

100,000

Per person negligent

50,000

Enforcement body

Privacy Protection Authority (Head of the Authority), a unit of Israel's Ministry of Justice

Obligation class

Governance