My company is outside Israel but we hold data on Israeli customers. Does Israel's privacy law apply to us?

Foreign businesses tend to assume Israeli privacy law is somebody else's problem until an Israeli customer sends a demand letter citing a statute they have never read. The uncomfortable answer is that Israel's regime has been rebuilt, it took effect on 14 August 2025, and it hangs on where the data subjects live rather than on where the server or the company sits.

---

Detailed Answer

The Privacy Protection Law 5741-1981 has always been drafted around the concept of a database, and Amendment 13 kept that architecture while sharpening everything attached to it. A collection of personal data on Israeli residents is an Israeli database for these purposes whether the company holding it is registered in Delaware, London or Sydney. What changed is enforcement. Before the amendment the Privacy Protection Authority was largely a supervisory body with criminal referral as its heavy weapon, which meant almost nothing happened. It now imposes administrative fines directly, running to roughly NIS 320,000 for a data security violation and into the millions of shekels for database and governance breaches, scaled by the size and sensitivity of the database. On 21 July 2026 the Authority fined a health fund NIS 256,000 for reporting a data security incident late under the Data Security Regulations 5777-2017, its first penalty aimed specifically at the notification duty, and that case is the clearest available signal of how the new powers will be used. Alongside the fines sits a civil route that matters more to a foreign defendant than the regulator does: an Israeli claimant can sue for statutory damages without proving any actual loss, and those claims aggregate quickly across a customer list.

Two structural duties catch foreign companies off guard. Registration of databases was narrowed rather than expanded, so most ordinary customer databases no longer need to be registered; what remains is databases whose main purpose is commercialising personal data on 10,000 or more people, and databases of public bodies. The appointment of a Data Protection Officer reaches further than registration does. It binds controllers of registrable databases, bodies whose core activity involves regular and systematic monitoring of individuals at significant scale, and controllers or processors whose main business is handling highly sensitive data at scale, which sweeps in health, financial and insurance operations that never thought of themselves as Israeli at all. For a company with no Israeli entity, the awkward questions are procedural rather than substantive: how the Authority serves notice at a foreign address, how a breach gets reported to a regulator in a different time zone inside the period the regulations allow, and who signs the Hebrew filings. Companies that already hold an Israeli subsidiary or a payroll presence should treat that as the natural anchor for compliance, and the structuring choice between the two is set out in our comparison of a foreign company branch and an Israeli subsidiary.

In Practice: Amendment 13 to the Privacy Protection Law 5741-1981 took effect on 14 August 2025, and the Privacy Protection Authority now levies administrative fines of about NIS 320,000 per data security violation, with database and governance breaches reaching into the millions. Its first breach-notification penalty, NIS 256,000 against a health fund on 21 July 2026, followed a late report under the Data Security Regulations 5777-2017. Registration is now confined to databases commercialising data on 10,000 or more individuals and to public-body databases, and the Authority allowed a grace period to 31 October 2025 on the new DPO requirement before enforcing it.

When to Consult a Lawyer

• You market to Israeli consumers through a website, app or mailing list and have never mapped which of your systems hold Israeli data. Scope has to be established before anyone can say whether a DPO or registration duty bites.
• You have suffered a security incident touching Israeli records. The reporting clock under the Data Security Regulations runs from discovery, and the July 2026 penalty shows the Authority prosecuting timing rather than the breach itself.
• An Israeli customer or former employee has sent a demand letter claiming statutory damages. These claims are cheap to bring, need no proof of loss, and behave very differently from a GDPR complaint.

---

Speak With an Israeli Attorney

We assess whether your database falls inside the Israeli regime, handle registration and DPO questions for a company with no Israeli entity, and manage breach reporting and Authority correspondence in Hebrew.

Contact us for a confidential initial consultation.