تُرجمت هذه الصفحة وتم التحقق منها آليًا. النسخة الإنجليزية هي المرجع. بعض الأجزاء لا تزال بالإنجليزية ريثما يتم التحقق من ترجمتها. عرض بالإنجليزية · الإبلاغ عن خطأ في الترجمة
اللوائح › بقية العالم › إسرائيل
PPL
قانون حماية الخصوصية، 5741-1981
التوقيتساري المفعول منذ 14 أغسطس 2025
من يتولى إنفاذههيئة حماية الخصوصية (PPA)، وزارة العدل
على من يسريكل من يتعدى على الخصوصية، ومالكو قواعد البيانات الشخصية وحائزوها ومعالجوها في إسرائيل، بما في ذلك الجهات العامة.
إبلاغ الجهة التنظيميةالإبلاغ عن أي حادث أمني جسيم إلى PPA فور اكتشافه، عبر نموذجها الإلكتروني
DPO مطلوبمطلوب للجهات العامة ووسطاء البيانات وجهات البريد المباشر التي تتجاوز 10,000 شخص، والجهات…
التسجيلالتسجيل مطلوب فقط لقواعد بيانات الجهات العامة وقواعد البيانات التي تضم 10,000 شخص فأكثر وتُستخدم أساسًا للتجا…
النقل إلى الخارجمسموح به فقط إذا كانت الحماية في الوجهة لا تقل عن الحماية في إسرائيل، أو بموجب الاستثناءات المدر…
مهلة الرد على الطلبات30 يومًا، وفقًا لمصادر ثانوية
الحد الأقصى للغرامةغرامات إدارية متدرجة، كثير منها عن كل صاحب بيانات (مثلًا ILS 4-8 عن كل شخص للبيانات الحساس…
Every requirement we score, with the rule in plain words and the section it comes from. Darker means more demanding. See every law side by side →
النطاق والأساس القانوني
النطاق خارج الحدود
1
No express extraterritorial clause; the PPA applies the law where processing has a material impact on Israelis, e.g. targeting the Israeli market or local servers.No statutory provision; PPA interpretation and case law · secondary source · source ↗
Sources disagree. The IL Tech Policy brief says the law reaches only entities within Israel's jurisdiction, while Chambers 2026 describes broader PPA practice. Treat this cell as uncertain.
الأساس القانوني
3
Informed consent is the main basis; the alternative is statutory authority. There is no legitimate-interests basis, and new purposes need new consent.ss. 1, 3, 8(b) · secondary source · source ↗
الموافقة
1
Consent must be informed and may be express or implied; courts and the PPA increasingly require specific, unbundled consent. Express consent is needed for electronic marketing.s. 3 (definition of consent); Aviv v Meta (2025) · secondary source · source ↗
The statute accepts implied consent. It is scored 1 because spam-law opt-in and PPA guidance require express consent for some uses.
البيانات الحساسة
1
'Information of special sensitivity' is broadly defined (incl. biometrics, location, financial data). It brings higher security levels, PPA notification above 100,000 people, DPO triggers and higher fines, but no ban.s. 3 (definition, as amended); s. 8A(b); s. 17B1 · secondary source · source ↗
There is no explicit-consent rule in the statute, although PPA guidelines (2025) prefer explicit consent. Section numbering follows the IL Tech Policy brief and LOC.
الأطفال
0
No age threshold in the PPL; minors under 18 lack full legal capacity, so parental consent is generally needed.Not in PPL; Legal Capacity and Guardianship Law, 5722-1962 · secondary source · source ↗
حقوق الأفراد
الحقوق
2
Access, correction or deletion of inaccurate data, deletion from direct-mail databases (opt-out), and erasure for EEA-origin data.ss. 13, 14, 17F; Regulations on Data Transferred from the EEA, 5783-2023 · secondary source · source ↗
Counted 4 rights: access, correction, deletion and objection (direct mail only). Deletion and objection are narrow, and there is no portability, restriction or automated-decision right.
مهلة الرد على الطلبات
2
30 days, per secondary sources.s. 13; Privacy Protection (Conditions for Inspection of Information and Procedure for Appeal) Regulations, 5741-1981 · secondary source · source ↗
Uncertain. The regulation number and day count could not be confirmed from the regulations themselves, and some practitioners cite 21 days for inspection. The 30-day appeal period for direct mail is in s. 17F(e).
التسويق
2
Prior written or electronic opt-in for commercial electronic messages, with a narrow existing-customer exception; the PPL also gives an absolute right to opt out of direct mail.Communications (Telecommunications and Broadcasting) Law, 5742-1982, s. 30A; PPL s. 17F · secondary source · source ↗
الحوكمة
DPO مطلوب
1
Required for public bodies, data brokers and direct mailers above 10,000 people, and entities whose core activity is systematic monitoring or large-scale special-sensitivity data.s. 17B1 · secondary source · source ↗
Banks, insurers, hospitals and health funds are named explicitly. A separate information security officer is still required under s. 17B for some entities.
مؤهلات DPO
1
The DPO needs in-depth knowledge of privacy law, an understanding of technology and information security, and no conflicting roles. The DPO reports to the CEO.ss. 17B2-17B3 · secondary source · source ↗
التسجيل
1
Registration only for public-body databases and databases of 10,000+ people mainly used to transfer data for payment; notify the PPA of special-sensitivity databases above 100,000 people.s. 8A(a)(1)-(2), 8A(b) · secondary source · source ↗
Before Amendment 13, registration was broad, covering 10,000+ subjects, sensitive data or direct marketing. The notification is due within 30 days of meeting the threshold.
DPIA
1
No general DPIA duty; the PPA recommends assessments, and high-security databases need periodic risk assessments and penetration tests.Data Security Regulations 5777-2017 (high-security tier); PPA guidance · secondary source · source ↗
The specific regulation number for risk assessments was not confirmed. The DPO's duties include overseeing risk assessments.
السجلات
2
Every database needs a database definition document (purposes, data types, transfers, processors) and written security procedures.Data Security Regulations 5777-2017, Reg. 2 · secondary source · source ↗
Chambers confirms the duty but not the regulation number; Reg. 2 comes from knowledge of the regulations.
الاحتفاظ
1
Delete data once its lawful purpose is exhausted and review holdings periodically, at least annually, for excess data; no statutory periods.PPA Data Minimization Policy (25 Mar 2021); Data Security Regulations 5777-2017 · secondary source · source ↗
The duty rests on PPA policy and the security regulations, not a PPL section.
حالات الخرق
إبلاغ الجهة التنظيمية
3
Report a severe security incident to the PPA immediately on discovery, through its online form.Data Security Regulations 5777-2017, Reg. 11; PPA guidance of 7 Aug 2022 (amended 1 Sept 2025) · secondary source · source ↗
Only 'severe' incidents are reportable, and what counts as severe depends on the database's security tier.
إخطار الأفراد
1
Notify affected individuals only if the PPA instructs it.Data Security Regulations 5777-2017, Reg. 11 · secondary source · source ↗
النقل
النقل إلى الخارج
2
Allowed only if the destination's protection is no lower than Israel's, or under listed exceptions such as consent, EU-adequate or Convention 108 countries, group or contractual safeguards; no PPA approval.Transfer of Data to Databases Abroad Regulations 5761-2001, Regs. 1-3 · secondary source · source ↗
A written undertaking from the recipient is required, and onward transfers are restricted. Separate regulations (5783-2023) govern data received from the EEA.
توطين البيانات
1
No general localization; sector rules (e.g., Bank of Israel Directives 362 and 364) restrict offshoring of banking data.No PPL provision; Bank of Israel Proper Conduct of Banking Business Directives 362, 364 · secondary source · source ↗
الإنفاذ
الحد الأقصى للغرامة
3
Tiered administrative fines, many per data subject (e.g., ILS 4-8 per person for sensitive databases), plus fixed amounts up to ILS 640,000 per violation; no overall cap stated.s. 23Z and Appendix; s. 23AC (5% of turnover reference); s. 23AD (doubling for repeats) · secondary source · source ↗
Scored 3 because per-person fines on databases with millions of records can exceed USD 5m. Daily fines of 1% apply to continuing violations. The source does not fully explain how the 5%-of-turnover mechanism works. Transliterated section letters follow the source.
المسؤولية الجنائية
2
Privacy infringement and breach of confidentiality carry up to 5 years in prison; Amendment 13 added offenses such as obstructing or misleading the PPA (6 months to 3 years).s. 5; s. 16; ss. 23BA-23BD · secondary source · source ↗
Amendment 13 removed the old strict-liability offenses (s. 31A).
الدعوى الخاصة
3
Civil tort claims plus statutory damages without proof of harm: up to ILS 10,000 for listed database violations, more for privacy infringement. Class actions are available.s. 4; s. 15A (Amendment 13); s. 29A; Class Actions Law 5766-2006 · secondary source · source ↗
The s. 29A cap is uncertain: Chambers 2026 says up to ILS 100,000, which is commonly understood as ILS 50,000, doubled where there was intent to harm. The limitation period is now 7 years for claims arising after 14 Aug 2025.
Scores are our reading on the published rubric, checked 18 October 2026. Not legal advice.
مكتبة التشريعات
جميع قوانين الخصوصية في الولايات الأمريكية على خريطة واحدة
لدى 24 ولاية قانون شامل للخصوصية في المكتبة، إلى جانب قوانين الاتحاد الأوروبي والمملكة المتحدة والقوانين الاتحادية الأمريكية والقوانين العالمية: 102 قانونًا إجمالًا، كل منها مشروح بلغة واضحة مع مصادره. اختر ولاية لمعرفة ما يسري فيها.
- ساري
- يدخل حيز التنفيذ
- القوانين القطاعية