Protection of Privacy Law (PPL) 5741-1981 Israel

• Enacted: May 1981
• Protection of Privacy Regulations (Data Security) 5777-2017: Enacted May 8, 2017; effective July 1, 2017
• Amendment 13: Published and effective immediately on August 14, 2024 

• Organizations and individuals in Israel that collect, store, or process personal data.
• Public bodies such as government departments and institutions.
• Private entities managing databases exceeding specific thresholds or handling sensitive data.
• Entities transferring data internationally.

• Data processing for personal or household use.
• Activities related to national security, defense, or public safety.

• Database Registration: Register databases containing personal information of over 10,000 individuals or sensitive data with the Registrar of Databases.
• Informed Consent: Obtain explicit consent from individuals before collecting or using their data.
• Data Security: Appoint a security supervisor for significant databases and implement measures to protect data integrity and confidentiality.
• Appoint a Data Protection Officer (DPO): Required for registration receivables (e.g., data brokers and public bodies), databases engaged in monitoring (e.g., telecoms), and databases primarily processing highly sensitive data (e.g., health organizations).
• Data Sharing Restrictions: Limit data sharing to purposes explicitly permitted under the law.
• Respond to Data Subject Requests: Comply with requests for access, correction, or deletion of personal data within 30 days. Extensions may apply for complex cases.

• Provide clear and accessible notices about data collection practices.
• Inform users of their rights and how to exercise them.
• Ensure compliance with cookie and tracking regulations.
• Facilitate user requests for access, correction, or deletion of personal data.

• Data Transfers: Ensure equivalent protection standards for data transferred abroad.
• Sensitive Data: Apply heightened safeguards for sensitive personal data, including health and biometric information.
• Public Body Obligations: Record and notify the Registrar of any regular information sharing activities.

Individuals have the right to:

• Access their personal data held by an organization.
• Request correction or deletion of inaccurate or outdated data.
• Object to data processing in specific circumstances.
• Be informed about how their data is processed and shared.

• Supervisory Authority: The Registrar of Databases, under the Ministry of Justice, oversees compliance.
• Penalties: Violations can lead to fines up to ₪50,000 (~USD 14,500), imprisonment of up to five years, or statutory damages for breaches.
• Civil Actions: Data subjects can file lawsuits for privacy violations.