Amendment 13: What Changed

Amendment 13 to the Privacy Protection Law is regarded as the broadest change to Israeli privacy law since the law was enacted. The Knesset approved it in August 2024, and it came into force on 14 August 2025. Since then, business owners, managers and nonprofits have been asking the same questions: what actually changed, and what do we need to do. This article reviews the main points of the amendment briefly and in plain language.

This article is a general overview. The text of the law and the guidance of the Privacy Protection Authority are the binding sources and are subject to updates accordingly, so before making decisions in your organization, check against the current text.

Why an amendment was needed

The Privacy Protection Law was enacted in 1981, long before personal data became central to running a business: apps, cloud services, digital marketing, cameras and customer management systems. The amendment aims to bring the law up to date with this reality and to bring Israeli law closer to the standards common in Europe (GDPR) and elsewhere.

The main changes

1. Enforcement powers for the Privacy Protection Authority

The amendment strengthens the Authority's powers, including the power to open administrative investigations and impose financial sanctions for violations. In practice, the law is no longer something that can be ignored, and an organization that does not comply may face administrative enforcement and heavy fines for failing to follow the guidelines. For the amounts and the circumstances in which they apply, review the current text of the law and the Authority's guidance.

2. A wider definition of personal and sensitive data

The amendment updates the definitions of the information the law applies to, and defines a category of particularly sensitive information. Medical, genetic, biometric and financial data are familiar examples of types of information that call for extra care. The more sensitive the data, the stricter the requirements. If your business holds this kind of data, check its classification explicitly.

3. Change to the database registration duty

In the past, many bodies had to register databases with the Registrar of Databases. According to published professional reviews, the amendment narrows the registration duty to certain types of databases, including those of public bodies and those mainly used for trading in information. This does not mean that an organization with no registration duty is exempt from privacy obligations. The substantive duties remain, including information security, a privacy policy and respect for individuals' rights.

4. Individuals' rights regarding data about them

The law continues to recognize a person's right to view the information held about them and to ask for it to be corrected, and the amendment reinforces the expectation that organizations know whose data they hold and act transparently. In practice, businesses need to be able to respond to a request from a customer, employee or user who asks what information is held about them.

5. A privacy protection officer for certain bodies

The amendment requires certain bodies to appoint a privacy protection officer. The type of body and the nature of its activity determine whether the duty applies. We covered this in more detail in Who Must Appoint a DPO, and the role is described on the Privacy Protection Officer page.

6. Information security and security incidents

The duty of information security exists in the law and its regulations, and remains central. An organization holding personal data must take reasonable measures to protect it, in line with its sensitivity and scale. Even though the amendment is not the whole picture, it is worth taking seriously the question of what you do when an incident occurs, who reports to whom, and within what timeframes.

What this means in practice for a small business

A small business holding customer details, such as an office, a clinic or an online shop, is not necessarily in the group of organizations required to appoint an officer. But the basic duties remain. In practice, pay attention to the following:

• What we collect and why. Every item of information collected must have a clearly defined purpose for its collection.
• Who has access. Access permissions for employees and suppliers, limited to those who need them.
• Where the data is kept. Local systems, the cloud, employees' personal phones.
• Who we share it with. Service providers, marketing companies, outside advisers.
• How long we keep it. Information that is no longer needed should be deleted under a clear policy.
• What the website says. An up-to-date, clear privacy policy that matches what is actually done. We will expand on this in a separate article.

Questions that come up often

Does the amendment apply to a small business? The Privacy Protection Law applies to anyone who holds personal data, including a small business. The difference lies in the scope of the requirements, which depends on the type and amount of data.

Should the website privacy policy be updated? It is worth checking. A policy written years ago does not necessarily reflect what the business does today, for example the use of analytics tools, marketing pixels or cloud providers.

What if a customer asks to see the information held about them? It helps to have a simple procedure: who receives the request, how the requester's identity is verified, and how quickly you respond.

Does employee data count? Yes. Information about employees and job candidates is also personal data covered by the law.

A simple starting plan

1. Map the data. A list of the databases in the organization, what they contain and who is responsible for them.
2. Classify sensitivity. Identify medical, financial, biometric or other data that needs extra protection.
3. Check whether an officer must be appointed. A written assessment of whether the duty applies to the organization.
4. Update policies and procedures. A privacy policy, an information security procedure, and procedures for handling requests and incidents.
5. Train staff. Employees are often the most exposed link. A short explanation and an annual refresher help.
6. Document. Keep the decisions and the reasons. Good records help even when nothing has happened.

Common mistakes

• Assuming the amendment is meant only for large companies.
• Assuming that an organization with no registration duty is exempt from every obligation.
• Copying a privacy policy from another website without checking that it matches what the business actually does.
• Leaving the subject to the IT department without management involvement.
• Not preparing a plan for a security incident in advance.

In summary

Amendment 13 changes how privacy is treated in Israel: more enforcement, more attention to sensitive data, and more requirements for any organization that holds information about people. The first step is not panic but order: map, classify, document and update. If you would like to check where your business stands, you are welcome to contact us for an initial conversation.

The information in this article is general and is not legal advice. The binding sources are the text of the law and the current guidance of the Privacy Protection Authority.