The primary legislation governing privacy, data protection and cybersecurity (in the context of personal data) in Israel is the Privacy Protection Law of 1981. This statute sets out the general provisions regarding the protection of privacy (not just in the context of processing) and personal data processing, both in the public and private sectors.
The data protection regulator is the Privacy Protection Authority, a semi-independent body equipped with broad enforcement powers to ensure compliance with the law.
The statute is supported by several sets of regulations. A key set is the Privacy Protection Regulations (Information Security), 2017, which establish specific data security requirements for the computerized processing of personal information.
The Privacy Protection Regulations (Transfer of Data to Databases Abroad), 2001 govern the export of personal data from Israel.
Additionally, the Privacy Protection Regulations (Instructions for Data that was Transferred to Israel from the European Economic Area), 2023 regulate the use of personal data originating from the European Economic Area. These regulations provide enhanced data minimization and transparency obligations, along with additional data subject rights such as the right to be forgotten, bringing Israeli law closer to the GDPR. These regulations were specifically promulgated to close gaps in Israeli law identified by the EU Commission.
Sector-specific provisions also apply to regulated entities, such as banks and insurance companies, imposing further obligations related to the protection of personal data on entities subject to their regulation. For more reading>>
Authors:
Eyal Roy Sage, Partner - Head of Law & Tech
Email: EYALS@AYR.CO.IL
Shir Shoshany-Katz, Partner
Email: SHIRS@AYR.CO.IL
Lior Talmud, Associate
Or Rotter Haphiloni, Associate
Yuval Achituv, Associate
Shir Shapira-Perez, Associate