ISRAEL Law and Practice Contributed by: Dan Or-Hof, Eran Gandman, Netanel Aharon and Matan Adar, Or-Hof Law
• public safety or security, where the transfer is nec - essary for such purposes; and • mandatory transfers required under Israeli law. Onward Transfers Following the PPA’s 2024–2025 position papers, Reg - ulation 3 is applied more flexibly: • controller consent – prior written approval required; • equivalency – onward transfer must meet the same standards as a direct transfer from Israel; and • sub-processing – sub-processors must be bound by equivalent obligations. EEA-Originating Data Under the EEA-originated Data Regulations, enhanced protections apply: • expanded rights – stronger erasure, accuracy, and notice rights apply regardless of nationality; and • purpose limitation – processing must strictly align with the original EEA transfer purpose. 5.2 Government Notifications and Approvals Export Control (Defence and Dual-Use) Israel maintains a stringent export control regime under the Defence Export Control Law (2007) and the Import and Export Order (Dual-Use). Scope of applicability The Export Control Law and Export Order apply to: • defence items – products, services, or know-how (including data) listed on the Defence Export Con - trol List, based on the Wassenaar Arrangement and Israeli security needs; • dual-use items – civilian goods with potential mili - tary application; and • encryption – defence-grade encryption (Ministry of Defence) and civilian encryption products (Ministry of Economy). Requirements and filings • Registration with the Defence Export Control Agency (DECA/API). • A marketing licence is required before negotiations or disclosure of technical data to foreign parties.
• An export licence is required for the actual transfer of goods or know-how. Privacy and Data Protection Cross-border transfers of personal data are regulated separately under the Data Transfer Regulations. Scope of applicability Any transfer of personal data from an Israeli database to a recipient outside Israel. Requirements and filings • Transfers of personal data do not require prior filing or approval from the PPA. • Where database registration is required, the regis - tration must disclose overseas data transfers. 5.3 Data Localisation Requirements There is no general data localisation or residency requirement under Israeli law. Instead, the PPL and the Data Transfer Regulations regulate cross-border transfers rather than mandating domestic storage. In practice, sector-specific regulation and the likely interpretation of what constitutes a “transfer” impose significant practical constraints. Data Localisation and Remote Access Across Sectors Sector-specific regimes govern data storage, security and access. Financial services, insurance and pen - sions, healthcare, and public bodies apply tailored rules reflecting confidentiality, risk, and national secu - rity concerns. Organisations operating across sectors must there - fore navigate overlapping and cumulative obligations. Financial Sector Example The financial sector demonstrates how functional localisation requirements arise in practice. Directive 362 (Cloud Computing) restricts banking corporations from storing or processing sensitive information on foreign cloud infrastructure unless GDPR-equivalent protection is ensured.
196 CHAMBERS.COM
Powered by FlippingBook