Privacy Authority Intensifies Enforcement Under New Law
Translated & summarized from Globes by baba
Israel's Privacy Protection Authority has initiated 178 proceedings and imposed over NIS 500,000 in fines since Amendment 13 to the Privacy Protection Law took effect in August 2025. The authority is actively investigating security incidents, data leaks, and notification violations across various sectors, including finance, healthcare, and local government. Legal experts emphasize that the amendment has transformed privacy compliance into a significant risk requiring senior management attention and ongoing managerial responsibility.
The story in 5 lines · by baba
- Israel's Privacy Protection Authority has opened 178 cases and levied over NIS 500,000 in fines since August 2025.
- Amendment 13 significantly expands the Privacy Protection Authority's enforcement powers and reporting obligations.
- Key enforcement actions target information security incidents, data leaks, and notification duty violations.
- Fines have been issued to United Health Fund, Menora Mivtachim, Beit Shemesh Municipality, and AD Karting Hutzot.
- Experts state privacy is now a major financial and reputational risk requiring senior management involvement.
Nearly a year and a half after Amendment 13 to the Privacy Protection Law took effect, the Privacy Protection Authority (PPA) in the Ministry of Justice is actively utilizing its expanded powers. The amendment, enacted in August 2025, aims to significantly bolster deterrence and enforcement against entities violating the law. The PPA has initiated 178 new proceedings, including oversight, administrative inquiries, and in-depth audits. Of these, 158 cases are currently active, while 20 have been closed. Additionally, the PPA manages 244 broader sector-wide oversight cases.
Notable enforcement actions have resulted in financial sanctions totaling over half a million shekels in four prominent cases. These include a NIS 256 fine for United Health Fund, a similar fine for Menora Mivtachim, NIS 64,000 for the Beit Shemesh Municipality, and NIS 12,000 for AD Karting Hutzot. The most common grounds for proceedings involve severe information security incidents, suspected data leaks, and violations related to notification duties and privacy policies. The PPA is also examining biometric data usage and surveillance systems.
Legal experts note a profound shift in how Israeli organizations approach privacy protection. Miriam Friedman, a partner at Arnon, Tadmor-Levy, stated that privacy obligations are no longer just a formal compliance issue but a significant financial, legal, and reputational risk requiring senior management involvement. She highlighted that the PPA now scrutinizes not only the outcome of an incident but also the organization's prior conduct and response, emphasizing ongoing managerial responsibility.
Dan Hai, a privacy expert and owner of Dan Hai & Co. law firm, confirmed the PPA's commitment to vigorous enforcement, citing the 178 open cases as evidence. He suggested that many organizations, particularly small and medium-sized businesses, may still need more time to adapt to the amendment's complex requirements and significant operational implications. Hai described the PPA's enforcement activities as substantial and impressive, noting that while these proceedings take time, they are actively occurring.