Israel's Privacy Amendment 13: What It Changes for Teams That Build, Buy or Maintain Software

TL;DR: Amendment 13 to Israel's Privacy Protection Law has been in force since 14 August 2025. The Privacy Protection Authority can now impose fines that scale with the number of people in a database. Most engineering duties sit in the 2017 Data Security Regulations, and breaking them now costs money. For a software project that means four jobs: know what personal data the system holds, set its security level, design permissions, access logs and deletion into the spec, and treat your software vendor as a data "holder" in the contract.

Last checked: September 2026. This is general information, not legal advice.

One fault, one late report, NIS 256,000

Law firms have covered Amendment 13 in detail. Your organization meets it somewhere else: in a screen that shows data to the wrong user, an access log nobody kept, a report that waited for the investigation to end.

In July 2026 the Privacy Protection Authority (PPA) announced its first fine under Amendment 13: NIS 256,000 against the Meuhedet health fund. A fault in a digital system let members view medical information about relatives. According to the published details, the fault surfaced in November 2025 and reached the PPA in January 2026. The PPA said the duty to report "immediately" starts when you learn of the incident, and waiting for every check to finish empties the word of meaning.

Every development team has seen an authorization bug like that one. What changed is the price.

What Amendment 13 changed, in brief

According to the PPA's guide to Amendment 13 (in Hebrew):

• Personal information covers any data about a person who is identified or identifiable with reasonable effort, including online identifiers and location data.
• Information of special sensitivity includes medical and genetic data, biometric identifiers, criminal records, political and religious views, origin, personality assessments, salary and financial activity, and location data that reveals any of these.
• Controller and holder. The controller decides why data is processed. A holder is any outside party that processes data for the controller. A software house with access to your production database fits that definition.
• Registration is almost gone for private companies. A database with specially sensitive data on more than 100,000 people must instead be reported to the PPA within 30 days, with its database definitions document.
• A privacy protection officer (DPO) is mandatory for public bodies, data traders with more than 10,000 people, and any controller or holder whose core business involves systematic monitoring of people or processing specially sensitive data at significant scale. Banks, insurers, hospitals and health funds are named explicitly.
• Fines. Processing data without authorization, or beyond it, costs NIS 4 per person in the database, NIS 8 if it holds specially sensitive data, with a floor of NIS 200,000. The PPA's own example: 200,000 people with such data reach NIS 1.6 million. At the violator's request, a fine above 5% of annual turnover is cut to 5%.
• Damages without proof of harm. For specific breaches, a court can award up to NIS 10,000 per violation: collecting data without the required notice, refusing a request to see the data, or failing to make a correction or deletion you agreed to. Processing data without the controller's authorization is also a criminal offense, with up to 3 years in prison.

Which security level applies to your system?

The Privacy Protection (Data Security) Regulations, 2017 set three levels. The level drives almost every engineering decision that follows, so settle it before you draw the architecture.

• Basic: any database outside the other two levels.
• Medium: a public body's database, a database built to pass data to others, or one with data on private life, health, genetics, biometrics, criminal records, political or religious views, communications, financial status, or consumption habits that reveal these. With ten or fewer authorized users, a database with these data types stays basic.
• High: a data-trading database, or one with these data types, that also covers 100,000 people or more or has more than 100 authorized users.

From law to code, area by area

Data mapping and minimization

How many fields in your sign-up form exist "just in case"? The regulations require a database definitions document: what you collect, why, which data types, what goes abroad, what a holder processes and the main risks. Once a year you must check that the database holds no more than its purpose needs.

In the spec this becomes a table. For each field: why you need it, where it lives, who sees it and how long you keep it. A field with no answer leaves the form.

The text beside the form is spec work too. Every request for personal data must now say whether giving it is mandatory and what happens on refusal, the purpose, who will receive it and why, and that the person can see and correct it. In the PPA's example, a website link that collected specially sensitive data from 500,000 people without that notice leads to a NIS 2 million fine.

Classifying sensitive data

Mark specially sensitive fields in the schema from day one. They set the security level, and with it the cost. Watch location data closely: an app that stores routes can reveal who visits a clinic or a synagogue every week, and location data that reveals a sensitive category is on the list itself.

Access control and logging

Permissions follow job definitions and cover only what each role needs. You keep a current list of valid permissions and revoke access the moment someone leaves a role. At the medium and high levels, an automatic log records every access attempt: who, when, which component, what type and scope, and whether it was approved. The log must resist being switched off, alert on any attempt, and stay for at least 24 months.

Cover the admin panel, support tools, the database console and BI reports as well. That is where most unplanned access happens. In QA, check that one user cannot open another user's record by changing an ID in the URL. Our guide to secure app development covers this class of bug.

Retention, deletion and encryption

Set a retention period per data type in the spec, and build deletion that reaches backups, copies and analytics. When you agree to correct or delete data, the law requires you to update everyone who received it too.

The regulations require accepted encryption for data sent over the internet and treat encryption as a reasonable measure on portable devices. In practice, encrypt all traffic, including between internal services, encrypt sensitive fields and backups at rest, and keep keys in a dedicated vault.

Security testing

High-level databases need a risk assessment and penetration tests at least every 18 months. At every level, software whose vendor has dropped security support needs a compensating control. Dependency scanning in CI and automated permission tests on every release catch most problems early. Give your QA team the permission matrix as part of the test plan.

Incident handling

Log every event that suggests unauthorized use of data, automatically where you can. Review incidents yearly at the medium level and quarterly at the high level. Report a severe incident to the PPA immediately.

The Meuhedet lesson is an engineering one. You need an alert that spots unusual access, a named person who decides an incident is "severe", and a template for an initial report based on what you know at that moment. The full investigation runs in parallel.

Your software house is a holder

A vendor that maintains, hosts or supports your system with access to data holds your database. Before you sign, assess the risks. Then the agreement must state:

• which data the vendor may process, and for what purpose
• which systems it may access, and which actions it may take
• the engagement's length, and how data is returned and destroyed at the end
• how the vendor meets its security duties
• confidentiality undertakings from every vendor employee with access
• the same terms for any permitted subcontractor
• a yearly compliance report, and notice of every security incident

Most security duties apply to the holder too. When the PPA fines a holder, it notifies the controller and orders it to stop the violation. A controller that fails to act can be fined the same amount. For more contract questions, see what CTOs should ask before signing with an agency.

Privacy by design starts in the spec

The spec is the cheapest place to comply. Add a "Personal data" chapter with the data map, the classification and security level, a permission matrix that includes internal tools, the events the access log records, flows for viewing, correcting and deleting data, the notice text at every collection point, a test data policy (production data stays out of dev and QA, or arrives masked), and incident contacts. Healthcare systems add more layers, covered in building healthcare apps in Israel.

Checklist by project phase

What to ask your vendor

1. Will your team touch production data? Who, from where and how much?
2. Which of the clauses the regulations require are already in your standard agreement?
3. Which subcontractors, cloud services and AI services will see the data?
4. How do you keep real data out of dev and QA?
5. How fast will you tell us about a security incident, and in what format?
6. How will you return and destroy the data when the engagement ends?

A vendor that answers these without hesitation has worked this way before.

Already live? Start with an audit

After years in production, it is hard to know exactly where personal data flows. Our code audit covers personal data handling, authorization flows, secret storage and encryption. It takes 2 to 4 weeks, typically costs $8K to $20K, and ends with a prioritized remediation plan.

Frequently asked questions

When did Amendment 13 to Israel's Privacy Protection Law take effect? On 14 August 2025. The Knesset approved it on 5 August 2024.

Is the software house that builds or maintains our system a "holder"? If it processes personal data for you, for example by accessing the production database, hosting the system or giving support with access to data, it fits the definition. Your agreement needs the terms in Regulation 15 of the Data Security Regulations, and you remain accountable as the controller.

Do we still need to register our database? Most private companies no longer do. Registration stays for public bodies and for databases built to pass data to others that hold data on more than 10,000 people. A database with specially sensitive data on more than 100,000 people must be reported to the PPA within 30 days.

How much does a breach of the data security regulations cost? It depends on the violation and the security level. Skipping penetration tests or failing to report a severe incident immediately in a high-level database costs NIS 320,000, doubled above one million data subjects. At the violator's request, a fine above 5% of annual turnover is cut to 5%.

Amendment 13 asks you to know what your system holds and to show you thought about it. If you are planning a new system or want to check an existing one, talk to us.