Amendment 13 to Israel's Privacy Protection Law, which takes effect in 2025, changes the rules of the game for businesses and organizations in Israel. With a renewed emphasis on protecting personal data and stricter enforcement of privacy regulations, businesses must adapt to the new requirements to maintain customer trust and avoid fines and violations.
What You Should Know: Israel's Privacy Protection Law
Israel's Privacy Protection Law was first enacted in 1981 to safeguard privacy rights in the collection, processing and use of personal data. In the digital era of advanced technologies, updating the law became critical. This led to a significant amendment, known as Amendment 13, which aims to align Israeli privacy protections with the European regulation (GDPR), effectively tightening the rules and requiring businesses to take stricter measures to protect personal data.
The law covers personal, financial and medical information, which includes, among other things, customer lists that you almost certainly have. In other words: any database containing other people's personal data, something nearly every organization holds today.
So What Has Actually Changed?
Amendment 13, approved in August 2024, introduces several key changes designed to strengthen the protection of personal data and adapt the law to today's digital reality:
- Mandatory reporting of privacy breaches
Every business or government body is required to give notice in the event of a data leak or unauthorized access to its customers' personal data.
- Data security management requirements
Amendment 13 tightens the requirements for securing personal data. Businesses must implement an advanced information security framework that includes access controls, encryption, risk management and periodic risk assessments.
This is where our obligation to take proactive steps to protect data comes from.
- Individual rights
The amendment grants individuals renewed rights over their personal data, including the right to access it, to correct inaccurate data and, in certain cases, to be deleted from a database.
What Does This Mean for Your Organization?
The new amendment presents businesses and organizations with significant challenges:
- Compliance is mandatory
Businesses in Israel must adapt their information management systems to the new requirements. This means substantial investment in information security systems, staff training and changes to day-to-day work processes to prevent violations and minimize risk.
- Penalties
Violating the law may result in significant fines and even sanctions. Amendment 13 increases penalties and empowers the Privacy Protection Authority to impose fines without proof of damage. In addition, the Authority will have the tools it needs to enforce the law effectively.
So What Should You Do Now?
To meet the new requirements, organizations and companies should appoint a dedicated professional to manage privacy and information security matters, who will conduct periodic audits and oversee information systems. They should also carry out risk assessments and periodic security reviews to identify potential risks and prevent breaches.
And they should remain transparent with customers about data collection and ensure that all data is collected with explicit consent.
So What Exactly Is DLP and Where Does It Fit In?
DLP, or "Data Loss Prevention," is a field of information security focused on protecting sensitive data from unauthorized access, use, transfer or exposure. DLP is a tool within recognized information security quality standards worldwide. The law requires us to manage our databases properly, and a data loss prevention system is exactly what helps us do that.
Organizations use DLP systems to identify, monitor and block activities that could lead to data leakage. In the digital era, organizations face many threats and challenges in protecting sensitive data. Open information systems, growing cloud adoption and workforce mobility mean that sensitive data is more exposed than ever to internal and external threats.
Stricter regulation essentially requires us to better safeguard the data we hold, and Data Loss Prevention (DLP) systems provide an excellent answer to that.
Did you know that 80% of companies suffer loss of data and sensitive information due to employee errors or malicious insider actions?
Here Are Some of the Reasons Organizations Need DLP
- Protecting sensitive data: Many organizations hold sensitive data such as national ID numbers, credit card details, medical information and trade secrets. This data can be valuable to criminals, so it is important to protect it from unauthorized access.
- Reducing leakage risk: A data leak can damage an organization's reputation and lead to financial penalties and even legal proceedings. DLP can help reduce the risk of leakage.
- Regulatory compliance: Many organizations are required to comply with information security regulations such as GDPR. DLP can help organizations meet these regulations.
Is your company also required to comply with regulations?
Schedule a free Zoom meeting with Adv. Lior Haim, GRC Team Leader, CISO & DPO, and find out.