Data Security Regulations and Amendment 13: what applies to you

A practical summary for management and IT teams, and how we help you meet each obligation.

Talk to an expert

The 2017 regulations

Protection of Privacy Regulations (Data Security), 2017

In force since 8 May 2018, they apply to database owners and holders and grade the obligations by security level.

Security levels: Basic, medium or high, depending on the type of information held and, for the high level, on the scale of the database.
Periodic audit: For the medium and high levels: an internal or external audit at least once every 24 months, by a party with appropriate training in information security auditing (regulation 16).
Risk survey and penetration tests: For the high level: at least once every 18 months (regulation 5).
Serious security incidents: For the medium and high levels: immediate notification to the Registrar at the Privacy Protection Authority (regulation 11).
Documentation: A database definition document and a security procedure, kept up to date.

Amendment 13

Amendment 13 to the Privacy Protection Law

In force since 14 August 2025, it gives the Privacy Protection Authority broader supervisory and enforcement powers, including administrative fines, and requires some organizations to appoint a DPO.

Who must appoint a DPO: Public bodies (including hospitals, health funds and universities), data brokers holding data on at least 10,000 people, and organizations whose core activities involve large-scale systematic monitoring or large-scale processing of especially sensitive data.
Authority guidance: The Privacy Protection Authority published its final guidance on the DPO obligation in July 2026. An external DPO is allowed, provided the role is held by a named person who meets the expertise and availability requirements it sets.
Enforcement: With administrative fines and wider supervisory powers, a compliance gap is now a financial risk as well as a legal one.

Regulated sectors

Healthcare, finance, insurance, education

Medical information is among the categories that place a database at the medium security level at least. These sectors also often combine large databases and requirements from their own regulator.

We take your sector requirements into account in the analysis when you share them with us.

How we help

From inventory to the next audit cycle

Scope
Inventory your databases, their owners and your processors.
Classify
Assign a security level to each database and list the obligations that apply.
Audit
Assess compliance with the Regulations and Amendment 13, in a prioritized report.
Remediate
Close the gaps, then prepare the next 24-month cycle.

FAQ

Israeli compliance: your questions

Does every company need the 24-month audit?

No. The periodic audit applies to databases at the medium or high security level. The first step is to classify each database.

Do we have to appoint a DPO?

It depends on your activity and its scale. Public bodies, data brokers above 10,000 people, and organizations whose core activity involves large-scale monitoring or large-scale processing of sensitive data are concerned. We help you document the analysis; the final legal position belongs to your legal counsel.

How does an engagement begin?

We start by clarifying your requirements, environment and deadlines. We then agree on the scope, the teams involved and the deliverables, from the initial assessment through remediation.

Does the GDPR also apply to us?

It can, if you offer goods or services to people in the European Union or monitor their behavior. Israel benefits from an EU adequacy decision, which eases transfers of personal data from the EU to Israel. We can map both frameworks together.

This page is a general summary, not legal advice. The binding version of the law and of the regulations is the Hebrew text published in the official gazette (Reshumot). Last reviewed: October 2026.

Source: Privacy Protection Authority, English translation of the Data Security Regulations (for information only).