Amendment 13 is in force. What changes on day one.
Israel's most significant privacy overhaul in over 40 years entered into force on 14 August 2025. Here is what it practically means for your company in the first 90 days.
Amendment 13 to the Privacy Protection Law is the most significant overhaul of Israeli privacy regulation in more than four decades. It aligns Israeli law more closely with the GDPR, sharply raises the regulator's enforcement powers, and for the first time mandates the appointment of a Data Protection Officer for a wide range of companies.
From day one, three obligations matter most: appointing a qualified DPO where required, maintaining an up-to-date Records of Processing Activities, and being ready to notify the Privacy Protection Authority of a security incident within the statutory timeframe. None of these are theoretical — the regulator has publicly signalled that enforcement will be active.
Our recommendation: do not wait for an Enterprise customer or a regulator to force the conversation. A short gap assessment, mapped to Amendment 13 and GDPR, will surface the two or three items that actually move your risk profile — usually vendor DPAs, DSAR handling, and breach response.