Privacy and Amendment 13
Amendment 13 to Israel's Privacy Protection Law: what your business needs to fix now
Amendment 13 to the Privacy Protection Law took effect on 14 August 2025. It broadened the definition of personal information, expanded what you must tell a person when you collect their details, and gave the Privacy Protection Authority power to impose significant administrative fines.
Most businesses don't need to appoint a privacy officer or register a database. But almost any business with a website form, a customer list or a CRM is covered. Adv. Alex Blumin helps businesses comply in practice: what you collect, where, who sees it, and what needs to be written and signed.
What this practice covers
- 01Mapping personal information in the business: what is collected, where, and who accesses it
- 02Privacy notices for forms and collection points (section 11)
- 03Website and app privacy policies
- 04Database definitions document and security procedure (Data Security Regulations, 2017)
- 05Agreements with vendors that process data for you
- 06Transfers of data abroad
- 07Checking whether a privacy officer (DPO) or a notice to the Authority is required
- 08Mailing lists and newsletters
- 09GDPR and CCPA for businesses working with Europe or the US
Real-life example
A website contact form connected to a spreadsheet and a mailing tool, with no one telling the person what happens to their details. That is collecting data without the notice section 11 requires.
When there is already a request or an inquiry
An inquiry from the Privacy Protection Authority, or a person asking to see the information about them. Start by mapping what was collected and who received it, and answer on time.
How I work
Map → gaps → documents → control. No dozens of pages nobody reads.
Related reading
Common questions
Does Amendment 13 apply to a small business?
Yes, in most cases. The law applies to anyone who collects, uses or processes personal information, and a database is any collection of personal information processed by digital means. There is a narrow exception, under conditions, for a list that holds only names, addresses and contact details. Caps on fines were set for small and micro businesses, but the obligations themselves still apply.
Do I need to register my business's database?
In most cases, no longer. After the amendment, the registration duty remains mainly for public bodies and for businesses whose main activity is collecting information to pass it to others, where the database holds information on 10,000 people or more. Alongside this, a duty was added to notify the Authority of a database with especially sensitive information on more than 100,000 people. A database that does not need registration is still subject to all the other obligations.
Who must appoint a privacy officer (DPO)?
Public bodies; businesses whose main activity is collecting information to pass it to others, with information on more than 10,000 people; anyone whose main activity involves systematic monitoring of people on a significant scale; and anyone whose main activity is processing especially sensitive information on a significant scale, such as banks, insurance companies, hospitals and health funds. Most small businesses are not included, but it is worth checking.
What must a form that collects details include?
Under section 11 of the law: why the information is requested, whether providing it is mandatory and what happens if not, who it will be passed to and why, who controls the database and how to contact them, and that there is a right to review the information and ask to correct it. The notice must be in plain language and appear at the moment of collection itself.
What is the risk if the business does not comply?
Three risks: administrative fines from the Authority, calculated by the type of breach and the number of people in the database; civil claims with compensation without proof of damage for breaches such as collecting without the required notice or refusing a review request; and in serious cases, criminal offences too. The shortened limitation period for privacy claims was abolished, so a claim can come years later.
Where do we start?
With mapping: which details you collect, in which forms and systems, who accesses them and which vendor they go to. The privacy notice, privacy policy, vendor agreements and data security documents follow from that.
Contact →The information on this page is general information and does not constitute legal advice. For legal advice tailored to your case, please contact Adv. Alex Blumin.