IsraelProtection of Privacy Law, comprehensive regime and database registration
Protection of Privacy Law, 5741-1981, as amended by Amendment No. 13, 5784-2024, Arts. 1-2, 4, 7-8A
In force since .
A comprehensive regime rule binding public and private bodies.
- Audit expectation
- none
What it requires
- An app that operates a database of the personal data of individuals in Israel above the small-collection thresholds must register with, or separately notify, the Privacy Protection Authority under Art. 8A, and must name a Data Protection Officer where the Act requires one.
These lines are LexLint's reading of the law's text. Also read by: Privacy Protection Authority (Israel Ministry of Justice) (guidance, recorded ).
In the frameworks
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://www.gov.il/BlobFolder/reports/guide_tikon13_professional/he/tikun%2013%20_170825.pdf
- Guidance body
- Privacy Protection Authority (Israel Ministry of Justice)
- Open questions
- Does 'main purpose is to collect personal data for providing it to another as a business practice or for consideration' in Article 8A(a)(1)(a) of the Protection of Privacy Law cover an app that shares user data with advertising partners as one source of revenue among others, so that its database must be registered once it holds data on more than 10,000 individuals?
What it makes you log
Who may demand the log
Regulator
Logging duty
Article 8A(b)(1) requires a controller of a database that holds data of special sensitivity about more than 100,000 individuals, and is not subject to registration, to give the Authority a copy of the database definitions document that the Data Security Regulations require, and Article 9(b) and (d) set the particulars a registration application states and require every change to be notified. The definitions document is a document the controller must have to be able to provide it; the Act does not itself say what it contains (Regulation 2 of the Data Security Regulations does), and it names no log, no retention period and no audit. Articles 1 to 2 and 4 set the general privacy tort and impose no record duty. The cited articles state no territorial hook.
- Kind
- Implicit
- As of
- Provision
- Article 8A(b)(1) and (2) (notice to the Authority with a copy of the database definitions document), with Article 9(b) and (d) (registration particulars and their updating)
- Trigger
- personal_data_processing
What this law does
Israel's Protection of Privacy Law, 5741-1981, creates a general tort of privacy infringement in Chapter A (Arts. 1-2, 4) and regulates 'databases' specifically from Art. 7 onward in Chapter B. A database excludes purely personal-use collections and small (100,000-or-fewer-person) name, address, or contact-only collections.
Amendment No. 13 rebuilt registration and notification duty at Art. 8A: mandatory registration is now limited to databases whose main purpose is commercial data provision with more than 10,000 individuals, or public-body databases, plus a separate notification duty, short of full registration, for any database holding special-sensitivity data on more than 100,000 individuals, including naming a Data Protection Officer where one is required.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .