76%
of Israel's 21 requirements are already met by European Union (GDPR). Here is what PPL adds, biggest gaps first.
Base legalAlcance e base legalBig gap
GDPR1 Six lawful bases, including consent, contract, legal obligation, vital interests, public task and legitimate interests.
PPL adds3 Informed consent is the main basis; the alternative is statutory authority. There is no legitimate-interests basis, and new purposes need new consent.
ss. 1, 3, 8(b) · source ↗
RegistroGovernançaGap
GDPR0 No general registration; controllers communicate DPO contact details to the supervisory authority.
PPL adds1 Registration only for public-body databases and databases of 10,000+ people mainly used to transfer data for payment; notify the PPA of special-sensitivity databases above 100,000 people.
s. 8A(a)(1)-(2), 8A(b) · source ↗
Avisar o reguladorViolaçõesGap
GDPR2 Notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware, unless risk is unlikely.
PPL adds3 Report a severe security incident to the PPA immediately on discovery, through its online form.
Data Security Regulations 5777-2017, Reg. 11; PPA guidance of 7 Aug 2022 (amended 1 Sept 2025) · source ↗
Localização de dadosTransferênciasGap
GDPR– Not addressed
PPL adds1 No general localization; sector rules (e.g., Bank of Israel Directives 362 and 364) restrict offshoring of banking data.
No PPL provision; Bank of Israel Proper Conduct of Banking Business Directives 362, 364 · source ↗
Responsabilidade criminalFiscalizaçãoGap
GDPR1 Member States set other penalties, including criminal penalties, for infringements not subject to administrative fines.
PPL adds2 Privacy infringement and breach of confidentiality carry up to 5 years in prison; Amendment 13 added offenses such as obstructing or misleading the PPA (6 months to 3 years).
s. 5; s. 16; ss. 23BA-23BD · source ↗
Already covered by GDPR: Reach abroad, Consent, Sensitive data, Children, Rights, Request deadline, Marketing, DPO required, DPO qualifications, DPIA, Records, Retention, Tell people, Transfers abroad, Maximum fine, Private action.
A gap means PPL is more demanding than GDPR on that requirement, on our 0 to 3 scale (how we score). Read the cited section before acting. Not legal advice.
