ISRAEL Law and Practice Contributed by: Dan Or-Hof, Eran Gandman, Netanel Aharon and Matan Adar, Or-Hof Law
for direct marketing databases and for personal data transferred from the EEA other than by the data subject. In other cases, data must be deleted once the lawful purpose is exhausted; no general “right to be forgotten” exists. • Transparency and disclosure (section 11): Before collection, organisations must provide a clear privacy notice identifying the controller, process - ing purposes, legal or contractual requirements, and consequences of refusal. Amendment No 13 strengthened enforcement of these obligations. • Mandatory DPO and accountability: Public bodies, data brokers and organisations engaged in large- scale or systematic processing of sensitive data must appoint a DPO and maintain statutory com - pliance documents, including database definitions, structure documentation, and a written information security procedure. Rights and Obligations for Non-Personal Data Israel lacks a horizontal equivalent to the EU Data Act; regulation therefore relies on sectoral rules and contracts. • Portability and interoperability: These apply only in regulated sectors, notably financial services (Finan - cial Information Service Law, 2021) and health - care (Health Information Mobility Law, 2024), with phased implementation through 2027. • Switching and termination: Outside regulated sec - tors, exit and data retention rights are governed primarily by contract, subject to trade secret pro - tections. • IP and trade secrets: Non-personal data is typi - cally protected as a trade secret under the Com - mercial Torts Law (1999), subject to reasonable safeguards. Main Necessary Action for Organisations To align with the 2026 framework, organisations should prioritise: • appointing a DPO and an information security officer, where required under the PPL, and consider voluntary appointment where thresholds are not met; • data mapping and classification, particularly of Data of Special Sensitivity;
• updating data processing agreements (DPAs) with vendors and cloud providers, and managing the vendor risk life cycle, including pre-engagement reviews, periodic cybersecurity audits, and over - sight; • maintaining and updating statutory documents under the Security Regulations; • adopting internal AI governance policies; • updating privacy notices to clearly disclose AI use, automated decision-making, and marketing activi - ties, including consequences of refusal; • conducting cybersecurity risk assessments and audits in line with the Security Regulations; and • establishing and testing a security incident and The enforcement of data protection and privacy in Israel is carried out by a co-ordinated network of authorities that has become increasingly integrated as of early 2026. The primary regulator, the PPA, now operates under a mandate significantly expanded by the 2025 reforms. The PPA The PPA is the lead authority enforcing the PPL. Fol - lowing Amendment No 13, it has transitioned from a registry-based supervisor to a full enforcement agen - cy. The PPA is authorised to impose administrative fines of up to ILS320,000 per cybersecurity violation and up to millions of shekels for database and per - sonal data governance violations; issue binding pro - cessing suspension orders; order deletion of unlawful databases (subject to court approval); and conduct criminal investigations, including searches and sei - The ICA enforces the Economic Competition Law and increasingly co-ordinates with the PPA where data concentration raises competition concerns. In 2025–2026, it scrutinised data-intensive mergers, particularly in the technology and fintech sectors. Co-ordination is formalised through inter-ministerial mechanisms, notably under the Financial Information Service Law, balancing data portability with privacy and security requirements. breach notification response plan. 3.4 Regulators and Enforcement zures under partial judicial oversight. The Israel Competition Authority (ICA)
191 CHAMBERS.COM
Powered by FlippingBook