What are the key data privacy laws and regulations?
Last review date: 31 December 2025
- The Protection of Privacy Law, 1981 ("Privacy Law") is the main law regulating privacy in Israel (privacy in general and privacy in computerized databases).
- The Protection of Privacy Regulations (Data Security), 2017 ("Data Security Regulations"), which determine the level of security and the security measures to be implemented in computerized databases.
- The Protection of Privacy Regulations (Transfer of Information to Databases outside the State's Boundaries), 2001 ("Transfer Regulations"), which regulate the transfer of personal data from Israeli databases outside the State of Israel.
- The Protection of Privacy Regulations (Instructions for Data that was Transferred to Israel from the European Economic Area), 2023 ("EEA Data Import Regulations") impose requirements on Israeli data controllers for: (a) personal data transferred from the EEA to Israel (excluding direct transfers by data subjects); and (b) additional personal data stored in Israeli databases containing EEA data. Obligations include deleting data, limiting the retention of unnecessary data, ensuring accuracy, and notifying data subjects.
In addition, there are guidelines published by the Israeli Protection of Privacy Authority (PPA), the Israeli regulator of privacy and data protection, dealing with specific matters (e.g., biometric data, surveillance cameras, outsourcing, processing of personal data by placement agencies, drones, guidelines for "smart cities," cloud services, responsibility of the board of directors in relation to data security, etc.) and additional sector-specific guidelines published by specific Israeli regulators in their respective fields (e.g., banking sector, finance sector, health sector, etc.)
What are the key cybersecurity laws and regulations?
Last review date: 31 December 2025
- The Privacy Law and the Data Security Regulations set out the obligation to safeguard personal data maintained in a computerized database, as well as the security standards to be applied.
- The Israeli Computers Law, 1995, which criminalizes unlawful computer-related misconduct, hacking or making malicious use of computers and computer programs.
- The Regulation of Security in Public Bodies Law, 1998, which regulates the protection of certain listed government and public bodies (e.g., telecommunication companies, national ports, transportation carriers, etc.) that provide essential public services and critical infrastructure, on matters relating to information security and cybersecurity.
- The Emergency Regulations (Iron Swords) (Dealing with Severe Cyber Attacks in the Digital Services and Hosting Services Sector), 2023, which expand the powers of the Israel National Cyber Directorate and give it the authority to issue binding instructions to certain digital services and hosting services businesses in the event of a cyberattack. The regulations have been extended and are valid until 31 January 2026.