Israel Protection of Privacy Law and Amendment 13

What it is

The Protection of Privacy Law, 5741-1981, is Israel’s data protection law. It sits alongside the Privacy Protection (Data Security) Regulations, which set security duties for databases in the private and public sectors. The Privacy Protection Authority (PPA), part of the Ministry of Justice, enforces both.

Amendment 13 is the most significant change to the law since it was enacted. The Knesset approved it on 5 August 2024 and it came into force on 14 August 2025. It modernised the law’s terms, expanded its duties and gave the PPA an enforcement regime with administrative fines. Only the Hebrew text is official. The PPA publishes unofficial English translations of the law and its regulations.

Israel has no AI-specific law. Its government AI policy relies on existing law and sector regulators, which makes the Protection of Privacy Law the main binding rule for most AI that handles information about people.

Who it applies to

The law applies to anyone who manages or holds a database of personal information in Israel, and to the processing of personal information more generally. Amendment 13 replaced the old term “database owner” with “controller”, and uses “holder” for an outside party that processes information on a controller’s behalf, close to the GDPR’s controller and processor.

An organisation that uses an AI vendor’s system to process its customers’ or employees’ information remains the controller. The vendor is usually a holder, with its own security duties.

What it requires

Wider definitions. Personal information now covers any data relating to an identified or identifiable person, including online identifiers such as IP addresses. Information of special sensitivity replaces the old “sensitive information” and includes genetic and biometric data, criminal records, personality assessments and location data.

Notice. When information is collected, people must be told more than before, including the controller’s identity and contact details, the purpose, whether they are legally required to provide the information, the consequences of refusing and their rights to review and correct it.

Privacy protection officers. Public bodies, data brokers holding information on more than 10,000 people, and controllers and holders whose core activities involve large-scale systematic monitoring or large-scale processing of information of special sensitivity must appoint a privacy protection officer.

Registration. Database registration is now limited to public bodies and to databases whose main purpose is providing information to others for business or value and that cover more than 100,000 people. A new duty to notify the PPA applies to databases holding information of special sensitivity about more than 100,000 people.

Enforcement. The PPA can impose administrative fines linked to the type of breach, the number of people affected and, in some cases, turnover. Its inspectors can demand information, enter premises and seize material, and it can issue warnings and orders to stop a breach. The general seven-year limitation period now applies to civil claims.

The PPA has also issued guidance on the role of an organisation’s board in overseeing data processing and security, and in 2025 it published draft guidance on applying the law to AI systems. That draft expects informed consent that explains how the AI system processes data, express mention of AI in privacy notices, a data protection impact assessment before personal data is processed with AI, controls on staff use of generative AI and strict handling of access and correction requests. It treats scraping personal data to train AI without consent as unlawful.

Key dates

• 1981. Protection of Privacy Law, 5741-1981, enacted.
• 5 August 2024. Knesset approves Amendment 13.
• 14 August 2025. Amendment 13 in force.

How it relates to other frameworks

The amended law is closer to the GDPR than before, but it is not the same. It still relies heavily on consent, and it has no equivalent of GDPR Article 22 on solely automated decisions. For AI, the obligations come through general duties of consent, notice, accuracy, security and access rights rather than a dedicated rule.

Israel’s AI policy leaves AI to sector regulators and soft law, aligned with the OECD AI Principles. Organisations that want a structure for AI governance on top of the privacy law often use ISO/IEC 42001 or the NIST AI RMF.

A note on this page

This is Aicura’s reading of the Protection of Privacy Law and Amendment 13. It is not legal advice and it is not the law itself. Only the Hebrew text is official. Read the law and the PPA’s guidance, and take advice on how they apply to your organisation.