Privacy Map

Middle East. National jurisdiction.

Israel IL

EU adequacy decisionPrimary authority: Privacy Protection Authority (PPA)
Part I

Domestic law

Comprehensive data protection1

  • PPLProtection of Privacy Law, 5741-1981 (as amended by Amendment No. 13)In force
    In force from     Israel's core privacy statute, covering privacy torts and the regulation of databases. Amendment 13 modernised it with GDPR-aligned definitions, a DPO duty, narrower database registration and strong administrative enforcement powers for the PPA.
    Synopsis

    Israel's core privacy statute, covering privacy torts and the regulation of databases. Amendment 13 modernised it with GDPR-aligned definitions, a DPO duty, narrower database registration and strong administrative enforcement powers for the PPA.

    Key themes
    • privacy torts
    • databases
    • registration
    • DPO
    • enforcement
    • statutory damages
    • sensitive data
    Unique features

    Statutory damages without proof of harm; registration now only for data brokers (>10,000 subjects) and public bodies; notice for very large sensitive-data databases (>100,000).

    SaaS relevance

    SaaS holding databases of Israeli data subjects (as owner or holder) must meet security, DPO and processor obligations.

    Extraterritorial
    Limited
    Breach notification
    PPA promptly for severe incidents (per Data Security Regulations); PPA may order individual notice
    DPO
    Conditional
    Cross-border transfers
    Transfer Regulations 2001: comparable protection or listed conditions + written undertaking
    Maximum penalty
    Administrative fines (tiered, per data subject scale) plus criminal sanctions
    Key dates
    • Adopted
    • In force
    • Amendment 13 approved 5 Aug 2024, in force 14 Aug 2025
    Text
    No authoritative text located.
    Authority
    Privacy Protection Authority (PPA)
    Verification

    High confidence.

    Official PPA site returned 403; specific fine amounts under Amendment 13 not verified.

    Full record for PPL

Cybersecurity1

  • Data Security RegulationsProtection of Privacy Regulations (Data Security), 5777-2017In force
    In force from     Detailed security requirements for database owners, holders and managers, scaled by the security level of the database, including policies, access controls, audits, training and incident reporting.
    Synopsis

    Detailed security requirements for database owners, holders and managers, scaled by the security level of the database, including policies, access controls, audits, training and incident reporting.

    Key themes
    • information security
    • risk tiers
    • audits
    • incident reporting
    • outsourcing
    Unique features

    Tiered obligations (basic, medium, high) and explicit outsourcing duties when using service providers.

    SaaS relevance

    SaaS vendors as database holders must implement the security level of their customers' databases and accept outsourcing terms.

    Extraterritorial
    Limited
    Breach notification
    PPA for severe incidents (immediately per PPA guidance)
    DPO
    Conditional
    Key dates
    • Adopted
    • In force
    Text
    Authority
    Privacy Protection Authority (PPA)
    Verification

    High confidence.

    [Link: PPA English translation on gov.il; Hebrew original is binding]

    Full record for Data Security Regulations

Data localisation / cross-border2

  • EEA Data RegulationsProtection of Privacy Regulations (Instructions for Data Transferred to Israel from the European Economic Area), 5783-2023In force
    In force from     Adds deletion, retention limitation, accuracy and notification duties for personal data received from the EEA, and expands sensitive categories for such data.
    Synopsis

    Adds deletion, retention limitation, accuracy and notification duties for personal data received from the EEA, and expands sensitive categories for such data.

    Key themes
    • EEA data
    • deletion
    • accuracy
    • transparency
    • sensitive data
    Unique features

    Treats ethnic origin and trade union membership as sensitive for EEA-sourced data.

    SaaS relevance

    Israel-based SaaS handling EU customer data must apply these enhanced duties.

    Extraterritorial
    No
    Key dates
    • Adopted
    • In force
    • Supported renewal of EU adequacy in Commission's January 2024 review
    Text
    Authority
    Privacy Protection Authority (PPA)
    Verification

    High confidence.

    [Link: Hebrew Reshumot (MoJ) copy, linked by Pearl Cohen; not loadable from here (geo-restricted)]

    Full record for EEA Data Regulations
  • Transfer RegulationsProtection of Privacy (Transfer of Data to Databases Abroad) Regulations, 5761-2001In force
    In force from     Allows transfer of personal data abroad only where the destination provides comparable protection or a listed condition applies, with a written undertaking from the recipient.
    Synopsis

    Allows transfer of personal data abroad only where the destination provides comparable protection or a listed condition applies, with a written undertaking from the recipient.

    Key themes
    • transfers
    • comparable protection
    • consent
    • recipient undertakings
    Unique features

    Data received from the EU/EEA is also subject to the 2023 regulations.

    SaaS relevance

    Israeli customers will require transfer undertakings from offshore SaaS processors.

    Extraterritorial
    No
    Cross-border transfers
    Comparable protection / listed conditions + written agreement
    Key dates
    • Adopted
    • In force
    Text
    Authority
    Privacy Protection Authority (PPA)
    Verification

    High confidence.

    [Link: Hebrew text hosted by PPA on gov.il; no official English found]

    Full record for Transfer Regulations
Part II

Regional & international frameworks

Membership-based — check ratification status in the instrument record. 9 instruments from 2 bodies.

Organisation for Economic Co-operation and Development (OECD)

  • OECD AI PrinciplesRecommendation of the Council on Artificial Intelligence (OECD AI Principles)In force
    In force from     Five values-based principles for trustworthy AI: inclusive growth and wellbeing; human rights and democratic values including privacy and fairness; transparency and explainability; robustness, security and safety; and accountability. These are paired with five recommendations to governments. The definition of an 'AI system' it contains was adopted in the EU AI Act.
    Synopsis

    Five values-based principles for trustworthy AI: inclusive growth and wellbeing; human rights and democratic values including privacy and fairness; transparency and explainability; robustness, security and safety; and accountability. These are paired with five recommendations to governments. The definition of an 'AI system' it contains was adopted in the EU AI Act.

    Key themes
    • trustworthy AI
    • human rights
    • privacy
    • transparency
    • explainability
    • robustness
    • accountability
    Unique features

    It was the first intergovernmental AI standard. Its AI-system definition was taken up in the EU AI Act and the CoE AI Convention.

    SaaS relevance

    Soft-law benchmark for AI governance in SaaS products, and the source of definitions used in binding laws.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    None
    Maximum penalty
    None
    Key dates
    • Adopted
    • In force
    • OECD/LEGAL/0449; adopted 2019-05-22; updated 2024-05-03 (generative AI, the definition of an AI system, safety, information integrity); G20 AI Principles (2019) draw on it
    Text
    Authority
    OECD Working Party on AI Governance / OECD.AI
    Sources consulted
    Verification

    High confidence.

    Full record for OECD AI Principles
  • OECD Trusted Government Access DeclarationDeclaration on Government Access to Personal Data Held by Private Sector EntitiesIn force
    In force from     The first intergovernmental statement of shared principles for government access to personal data held by private companies for law enforcement and national security. It covers seven principles: legal basis, legitimate aims, approvals, data handling, transparency, oversight and redress.
    Synopsis

    The first intergovernmental statement of shared principles for government access to personal data held by private companies for law enforcement and national security. It covers seven principles: legal basis, legitimate aims, approvals, data handling, transparency, oversight and redress.

    Key themes
    • government access
    • national security
    • law enforcement
    • legal basis
    • oversight
    • redress
    • transparency
    Unique features

    It codifies democratic safeguards on compelled access. It was cited in the context of the EU–US Data Privacy Framework and in transfer impact assessments.

    SaaS relevance

    Useful reference for transfer impact assessments and for policies on responding to government data demands.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    Supports trusted data flows between adherents
    Maximum penalty
    None
    Key dates
    • Adopted
    • In force
    • OECD/LEGAL/0487; adopted at the Digital Economy Ministerial meeting on 2022-12-14; the EU also adhered
    Text
    Authority
    None designated
    Sources consulted
    Verification

    High confidence.

    Full record for OECD Trusted Government Access Declaration
  • OECD Privacy Guidelines 2013Recommendation of the Council concerning Guidelines Governing the Protection of Privacy and Transborder Flows of Personal Data (revised 2013)In force
    In force from     Keeps the eight 1980 principles and adds new implementation ideas: privacy management programmes, breach notification to authorities and individuals, national privacy strategies, privacy enforcement authorities with adequate powers, and interoperability between privacy frameworks.
    Synopsis

    Keeps the eight 1980 principles and adds new implementation ideas: privacy management programmes, breach notification to authorities and individuals, national privacy strategies, privacy enforcement authorities with adequate powers, and interoperability between privacy frameworks.

    Key themes
    • accountability
    • privacy management programmes
    • breach notification
    • enforcement cooperation
    • interoperability
    • transborder flows
    Unique features

    It made the controller's accountability programme concrete and introduced breach notification into an intergovernmental instrument. It favours a risk-based approach to transborder restrictions.

    SaaS relevance

    It informs accountability-programme expectations in many OECD countries' laws that apply to SaaS providers.

    Breach notification
    Recommended: authority and affected individuals for significant breaches
    DPO
    No
    Cross-border transfers
    Restrictions should be proportionate to risk
    Maximum penalty
    None
    Key dates
    • Adopted
    • In force
    • OECD/LEGAL/0188; first adopted 1980-09-23; revised 2013-07-11; implementation reviews continue
    Text
    Authority
    OECD Working Party on Data Governance and Privacy
    Sources consulted
    Verification

    High confidence.

    Full record for OECD Privacy Guidelines 2013
  • OECD Guidelines 1980OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data (1980)Repealed/superseded
    In force from     A non-binding OECD Council Recommendation that set out eight basic principles: collection limitation, data quality, purpose specification, use limitation, security safeguards, openness, individual participation and accountability. It also encouraged free transborder flows between member countries.
    Synopsis

    A non-binding OECD Council Recommendation that set out eight basic principles: collection limitation, data quality, purpose specification, use limitation, security safeguards, openness, individual participation and accountability. It also encouraged free transborder flows between member countries.

    Key themes
    • eight fair information principles
    • accountability
    • transborder flows
    Unique features

    These eight principles became the global baseline that APEC, Canadian PIPEDA, Australian law and many others draw on. It was adopted at about the same time as Convention 108.

    SaaS relevance

    Historical baseline; its principles are reflected in most national laws a SaaS provider meets.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    Free flow encouraged; restrictions only where proportionate
    Maximum penalty
    None
    Key dates
    • Adopted
    • In force
    • Ended
    • Revised 2013-07-11 (see separate row)
    Text
    Authority
    None designated
    Sources consulted
    Verification

    High confidence.

    The 1980 text was replaced by the 2013 revision of the same instrument (OECD/LEGAL/0188).

    Full record for OECD Guidelines 1980

United Nations

  • UN Cybercrime ConventionUnited Nations Convention against Cybercrime; Strengthening International Cooperation for Combating Certain Crimes Committed by Means of Information and Communications Technology Systems and for the Sharing of Evidence in Electronic Form of Serious CrimesSigned – not ratified
    The first global UN treaty on cybercrime. It requires states to criminalise a set of computer-related offences and to provide procedural powers, such as preserving and producing stored data and collecting traffic and content data, and it sets up channels for cross-border e-evidence cooperation on serious crimes. It includes a general human rights clause and conditions and safeguards on these powers.
    Synopsis

    The first global UN treaty on cybercrime. It requires states to criminalise a set of computer-related offences and to provide procedural powers, such as preserving and producing stored data and collecting traffic and content data, and it sets up channels for cross-border e-evidence cooperation on serious crimes. It includes a general human rights clause and conditions and safeguards on these powers.

    Key themes
    • cybercrime offences
    • e-evidence
    • production orders
    • data preservation
    • mutual legal assistance
    • human rights safeguards
    Unique features

    It is broader than the Budapest Convention in that evidence sharing covers any 'serious crime'. Rights groups and industry have criticised its safeguards as weak.

    SaaS relevance

    Once in force and implemented, it could widen the range of states able to issue preservation and production orders to cloud and SaaS providers.

    Extraterritorial
    Limited
    Breach notification
    None
    DPO
    No
    Cross-border transfers
    Cooperation channels for electronic evidence
    Maximum penalty
    Set by national law
    Key dates
    • Adopted
    • Adopted by the UN General Assembly in December 2024; opened for signature in Hanoi on 2025-10-25; enters into force 90 days after the 40th ratification. About 3 ratifications (Qatar, Azerbaijan, Viet Nam) as of mid-2026.
    Text
    Authority
    UNODC (secretariat); Conference of the States Parties once in force
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. The ratification count comes from secondary sources as of mid-2026. The convention is not in force (it needs 40 ratifications). The exact GA adoption date (24 Dec 2024, A/RES/79/243) comes from established references and I did not re-verify it.

    Full record for UN Cybercrime Convention
    Partly verifiedMedium confidence. The ratification count comes from secondary sources as of mid-2026. The convention is not in force (it needs 40 ratifications). The exact GA adoption date (24 Dec 2024, A/RES/79/243) comes from established references and I did not re-verify it.
  • Right to privacy in the digital ageUN General Assembly resolutions on the right to privacy in the digital age (series)In force
    In force from     This is a recurring series of non-binding General Assembly resolutions. They confirm that people have the same privacy rights online as offline, and they ask states to review surveillance, interception and bulk data collection against international human rights law. Later resolutions also cover AI, biometrics, encryption and data brokers.
    Synopsis

    This is a recurring series of non-binding General Assembly resolutions. They confirm that people have the same privacy rights online as offline, and they ask states to review surveillance, interception and bulk data collection against international human rights law. Later resolutions also cover AI, biometrics, encryption and data brokers.

    Key themes
    • surveillance
    • interception
    • AI and privacy
    • encryption
    • business responsibility
    • remedies
    Unique features

    The series grew out of the 2013 Snowden revelations. It led to OHCHR reports and, through the Human Rights Council, to the Special Rapporteur on privacy.

    SaaS relevance

    These are soft-law expectations on business respect for privacy (UN Guiding Principles), which are relevant to transparency reporting and to how a provider handles government data requests.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    None
    Maximum penalty
    None
    Key dates
    • Adopted
    • In force
    • First resolution A/RES/68/167 (2013-12-18); renewed roughly every two years; latest verified A/RES/79/175 adopted 2024-12-17
    Text
    Authority
    Office of the UN High Commissioner for Human Rights (OHCHR) reports; UN Special Rapporteur on the right to privacy
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. Treated as one row for the whole series. I did not check whether a newer resolution was adopted at the 80th session in late 2025.

    Full record for Right to privacy in the digital age
    Partly verifiedMedium confidence. Treated as one row for the whole series. I did not check whether a newer resolution was adopted at the 80th session in late 2025.
  • ICCPR Art 17International Covenant on Civil and Political Rights, Article 17In force
    In force from     This is a binding treaty. Article 17 bans arbitrary or unlawful interference with privacy, family, home or correspondence, and requires states parties to protect people from such interference by law. The Human Rights Committee monitors compliance through state reports and, for states that accept it, individual complaints.
    Synopsis

    This is a binding treaty. Article 17 bans arbitrary or unlawful interference with privacy, family, home or correspondence, and requires states parties to protect people from such interference by law. The Human Rights Committee monitors compliance through state reports and, for states that accept it, individual complaints.

    Key themes
    • right to privacy
    • state obligations
    • legality
    • arbitrariness
    • individual communications
    Unique features

    It is the main binding global privacy guarantee and has about 170+ parties. General Comment 16 reads it as covering the gathering and holding of personal information, including by private bodies.

    SaaS relevance

    It binds states, not companies, but it shapes national privacy laws and the rules on government access to the data SaaS providers hold.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    None
    Maximum penalty
    None (treaty-body views; no fines)
    Key dates
    • Adopted
    • In force
    • Adopted by GA resolution 2200A (XXI) on 1966-12-16; in force 1976-03-23. Human Rights Committee General Comment No. 16 on Article 17 was issued in 1988.
    Text
    Authority
    UN Human Rights Committee (treaty body)
    Sources consulted
    Verification

    High confidence.

    The party count is approximate and was not re-checked against the UN Treaty Collection.

    Full record for ICCPR Art 17
  • UDHR Art 12Universal Declaration of Human Rights, Article 12In force
    In force from     Article 12 says no one may be subjected to arbitrary interference with their privacy, family, home or correspondence, and that everyone is entitled to legal protection against such interference. It is a declaration rather than a treaty, but it is the starting point for privacy as an international human right.
    Synopsis

    Article 12 says no one may be subjected to arbitrary interference with their privacy, family, home or correspondence, and that everyone is entitled to legal protection against such interference. It is a declaration rather than a treaty, but it is the starting point for privacy as an international human right.

    Key themes
    • right to privacy
    • correspondence
    • reputation
    • protection of the law
    Unique features

    Not legally binding in itself, though many of its provisions are treated as customary international law. Every later privacy instrument, from the ECHR to the ICCPR, builds on this text.

    SaaS relevance

    Gives no direct obligations to a SaaS business; it is useful as the human rights background for policies and DPIAs.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    None
    Maximum penalty
    None
    Key dates
    • Adopted
    • In force
    • Proclaimed by the UN General Assembly in Paris on 10 December 1948
    Text
    Authority
    None designated
    Sources consulted
    Verification

    High confidence.

    The CIPP/E project holds a copy (1948UDHR.pdf).

    Full record for UDHR Art 12
  • UN Guidelines 1990Guidelines for the Regulation of Computerized Personal Data FilesIn force
    In force from     Non-binding guidelines from the General Assembly that set minimum guarantees for national laws on computerised personal data files, covering both public and private files. They list principles such as lawfulness and fairness, accuracy, purpose specification, interested-person access, non-discrimination, security and independent supervision.
    Synopsis

    Non-binding guidelines from the General Assembly that set minimum guarantees for national laws on computerised personal data files, covering both public and private files. They list principles such as lawfulness and fairness, accuracy, purpose specification, interested-person access, non-discrimination, security and independent supervision.

    Key themes
    • fair information principles
    • sensitive data
    • access
    • security
    • supervisory authority
    • transborder flows
    Unique features

    Separate provisions extend the principles to files held by international governmental organisations. They also have an early non-discrimination rule on sensitive data and allow transfers to countries with comparable safeguards.

    SaaS relevance

    Gives no direct obligations; it is historical background to UN-system data protection policies.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    Free flow to states with comparable safeguards
    Maximum penalty
    None
    Key dates
    • Adopted
    • In force
    Text
    Authority
    None designated
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. I did not open the resolution text in this session. The resolution number and date come from established references. Refworld is a UNHCR mirror; the official text is in the UN Digital Library under A/RES/45/95.

    Full record for UN Guidelines 1990
    Partly verifiedMedium confidence. I did not open the resolution text in this session. The resolution number and date come from established references. Refworld is a UNHCR mirror; the official text is in the UN Digital Library under A/RES/45/95.