Amendment 13 to the Privacy Protection Law:what changed and what to do now

Amendment 13 to the Privacy Protection Law is the most far-reaching reform of Israel's privacy law since 1996. The Knesset passed it in August 2024, and it took effect on 14 August 2025. It affects almost every business that holds information about customers, employees or website visitors.

It is not only about large companies or tech firms. Here are the main changes in plain language, and what is worth checking in your business now.

Who does it affect?

Almost every business holds personal information, even if it has never thought about it. For example:

• An online shop that stores customer details and orders.
• An office that keeps client files.
• An employer that keeps records on staff and job applicants.
• A website with a contact form, a mailing list or an analytics tool.

A broader definition of personal information

The amendment widens the definition of personal information. It is no longer only a name, an ID number or an address, but any information that can be linked to a specific person, even indirectly.

Online identifiers such as IP addresses can count as personal information too. In other words, a website that never asks anyone for their name may still be collecting personal information without realising it. So it is worth taking a fresh look at what counts as personal information in your business.

Especially sensitive information

The amendment creates a category of especially sensitive information. These are types of information whose exposure could harm a person more than usual, such as information about their health, so the law is stricter about them.

A business that holds such information needs to know it, and make sure the protection matches how sensitive the information is.

Less registration, more responsibility

In the past, many databases had to be registered. The amendment sharply narrowed that duty, which now applies only to certain types of databases.

But less registration does not mean less responsibility. The focus has shifted from filing a form with the database registrar to how the business actually protects the information.

A privacy protection officer

Under the amendment, some organisations must appoint a privacy protection officer. Whether the duty applies depends on the type of organisation and the nature of its work with personal information.

The officer's job is to make sure the organisation complies with the law, and to be the internal point of contact for privacy questions.

New enforcement powers

The Privacy Protection Authority now has much wider enforcement powers. Among other things, it can impose administrative fines on those who break the law.

In practice, this means a breach is no longer only a risk of being sued. It can also lead to action by the Authority itself. So it is worth treating the amendment as a chance to get organised, not only as an obligation.

What can you do now?

There is no need to wait for an inspection. Here are a few steps any business can start with:

1. Map what personal information the business collects, from whom, for what purpose and where it is stored.
2. Review the privacy policy on your website and app, and the notice people receive when you ask them for information.
3. Check your information security: who can access the data, how it is protected, and what happens when an employee leaves.
4. Go through your agreements with suppliers that process data for you, such as cloud services, mailing platforms and payroll systems.
5. Check whether the business must register a database or appoint a privacy protection officer.
6. Train the employees who work with personal information.
7. Decide in advance what to do if a leak or breach is discovered.

In short

Amendment 13 does not change the basic idea of the law: information about a person belongs to that person. It does change the level of detail, and the way the law is enforced. A business that maps its data and puts its documents in order in good time is in a better position. If you are not sure which duties apply to your business, check with a lawyer.

This article is general information, not legal advice. For advice on your situation, contact the office.