Página traduzida e verificada automaticamente. Prevalece a versão em inglês. Algumas partes ainda estão em inglês enquanto a tradução é verificada. Ver em inglês · Informar um erro de tradução
Regulamentações › Resto do mundo › Israel
PPL
Lei de Proteção da Privacidade, 5741-1981
QuandoEm vigor desde 14 de agosto de 2025
Quem fiscalizaAutoridade de Proteção da Privacidade (PPA), Ministério da Justiça
A quem se aplicaQualquer pessoa que viole a privacidade, e proprietários, detentores e operadores de bancos de dados pessoais em Israel, incluindo órgãos públicos.
Avisar o reguladorComunicar um incidente de segurança grave à PPA imediatamente após a descoberta, por meio do formulário on-line
DPO obrigatórioExigido para órgãos públicos, corretores de dados e empresas de mala direta acima de 10,000 pessoas, e entidades…
RegistroRegistro apenas para bancos de dados de órgãos públicos e bancos de dados com 10,000+ pessoas usados principalmente para tra…
Transferências para o exteriorPermitida somente se a proteção no destino não for inferior à de Israel, ou nas exceções lis…
Prazo para solicitações30 dias, segundo fontes secundárias
Multa máximaMultas administrativas escalonadas, muitas por titular dos dados (p. ex., ILS 4-8 por pessoa para dados sensív…
Every requirement we score, with the rule in plain words and the section it comes from. Darker means more demanding. See every law side by side →
Alcance e base legal
Alcance extraterritorial
1
No express extraterritorial clause; the PPA applies the law where processing has a material impact on Israelis, e.g. targeting the Israeli market or local servers.No statutory provision; PPA interpretation and case law · secondary source · source ↗
Sources disagree. The IL Tech Policy brief says the law reaches only entities within Israel's jurisdiction, while Chambers 2026 describes broader PPA practice. Treat this cell as uncertain.
Base legal
3
Informed consent is the main basis; the alternative is statutory authority. There is no legitimate-interests basis, and new purposes need new consent.ss. 1, 3, 8(b) · secondary source · source ↗
Consentimento
1
Consent must be informed and may be express or implied; courts and the PPA increasingly require specific, unbundled consent. Express consent is needed for electronic marketing.s. 3 (definition of consent); Aviv v Meta (2025) · secondary source · source ↗
The statute accepts implied consent. It is scored 1 because spam-law opt-in and PPA guidance require express consent for some uses.
Dados sensíveis
1
'Information of special sensitivity' is broadly defined (incl. biometrics, location, financial data). It brings higher security levels, PPA notification above 100,000 people, DPO triggers and higher fines, but no ban.s. 3 (definition, as amended); s. 8A(b); s. 17B1 · secondary source · source ↗
There is no explicit-consent rule in the statute, although PPA guidelines (2025) prefer explicit consent. Section numbering follows the IL Tech Policy brief and LOC.
Crianças
0
No age threshold in the PPL; minors under 18 lack full legal capacity, so parental consent is generally needed.Not in PPL; Legal Capacity and Guardianship Law, 5722-1962 · secondary source · source ↗
Direitos das pessoas
Direitos
2
Access, correction or deletion of inaccurate data, deletion from direct-mail databases (opt-out), and erasure for EEA-origin data.ss. 13, 14, 17F; Regulations on Data Transferred from the EEA, 5783-2023 · secondary source · source ↗
Counted 4 rights: access, correction, deletion and objection (direct mail only). Deletion and objection are narrow, and there is no portability, restriction or automated-decision right.
Prazo para solicitações
2
30 days, per secondary sources.s. 13; Privacy Protection (Conditions for Inspection of Information and Procedure for Appeal) Regulations, 5741-1981 · secondary source · source ↗
Uncertain. The regulation number and day count could not be confirmed from the regulations themselves, and some practitioners cite 21 days for inspection. The 30-day appeal period for direct mail is in s. 17F(e).
Marketing
2
Prior written or electronic opt-in for commercial electronic messages, with a narrow existing-customer exception; the PPL also gives an absolute right to opt out of direct mail.Communications (Telecommunications and Broadcasting) Law, 5742-1982, s. 30A; PPL s. 17F · secondary source · source ↗
Governança
DPO obrigatório
1
Required for public bodies, data brokers and direct mailers above 10,000 people, and entities whose core activity is systematic monitoring or large-scale special-sensitivity data.s. 17B1 · secondary source · source ↗
Banks, insurers, hospitals and health funds are named explicitly. A separate information security officer is still required under s. 17B for some entities.
Qualificações do DPO
1
The DPO needs in-depth knowledge of privacy law, an understanding of technology and information security, and no conflicting roles. The DPO reports to the CEO.ss. 17B2-17B3 · secondary source · source ↗
Registro
1
Registration only for public-body databases and databases of 10,000+ people mainly used to transfer data for payment; notify the PPA of special-sensitivity databases above 100,000 people.s. 8A(a)(1)-(2), 8A(b) · secondary source · source ↗
Before Amendment 13, registration was broad, covering 10,000+ subjects, sensitive data or direct marketing. The notification is due within 30 days of meeting the threshold.
DPIA
1
No general DPIA duty; the PPA recommends assessments, and high-security databases need periodic risk assessments and penetration tests.Data Security Regulations 5777-2017 (high-security tier); PPA guidance · secondary source · source ↗
The specific regulation number for risk assessments was not confirmed. The DPO's duties include overseeing risk assessments.
Registros
2
Every database needs a database definition document (purposes, data types, transfers, processors) and written security procedures.Data Security Regulations 5777-2017, Reg. 2 · secondary source · source ↗
Chambers confirms the duty but not the regulation number; Reg. 2 comes from knowledge of the regulations.
Retenção
1
Delete data once its lawful purpose is exhausted and review holdings periodically, at least annually, for excess data; no statutory periods.PPA Data Minimization Policy (25 Mar 2021); Data Security Regulations 5777-2017 · secondary source · source ↗
The duty rests on PPA policy and the security regulations, not a PPL section.
Violações
Avisar o regulador
3
Report a severe security incident to the PPA immediately on discovery, through its online form.Data Security Regulations 5777-2017, Reg. 11; PPA guidance of 7 Aug 2022 (amended 1 Sept 2025) · secondary source · source ↗
Only 'severe' incidents are reportable, and what counts as severe depends on the database's security tier.
Informar as pessoas
1
Notify affected individuals only if the PPA instructs it.Data Security Regulations 5777-2017, Reg. 11 · secondary source · source ↗
Transferências
Transferências para o exterior
2
Allowed only if the destination's protection is no lower than Israel's, or under listed exceptions such as consent, EU-adequate or Convention 108 countries, group or contractual safeguards; no PPA approval.Transfer of Data to Databases Abroad Regulations 5761-2001, Regs. 1-3 · secondary source · source ↗
A written undertaking from the recipient is required, and onward transfers are restricted. Separate regulations (5783-2023) govern data received from the EEA.
Localização de dados
1
No general localization; sector rules (e.g., Bank of Israel Directives 362 and 364) restrict offshoring of banking data.No PPL provision; Bank of Israel Proper Conduct of Banking Business Directives 362, 364 · secondary source · source ↗
Fiscalização
Multa máxima
3
Tiered administrative fines, many per data subject (e.g., ILS 4-8 per person for sensitive databases), plus fixed amounts up to ILS 640,000 per violation; no overall cap stated.s. 23Z and Appendix; s. 23AC (5% of turnover reference); s. 23AD (doubling for repeats) · secondary source · source ↗
Scored 3 because per-person fines on databases with millions of records can exceed USD 5m. Daily fines of 1% apply to continuing violations. The source does not fully explain how the 5%-of-turnover mechanism works. Transliterated section letters follow the source.
Responsabilidade criminal
2
Privacy infringement and breach of confidentiality carry up to 5 years in prison; Amendment 13 added offenses such as obstructing or misleading the PPA (6 months to 3 years).s. 5; s. 16; ss. 23BA-23BD · secondary source · source ↗
Amendment 13 removed the old strict-liability offenses (s. 31A).
Ação privada
3
Civil tort claims plus statutory damages without proof of harm: up to ILS 10,000 for listed database violations, more for privacy infringement. Class actions are available.s. 4; s. 15A (Amendment 13); s. 29A; Class Actions Law 5766-2006 · secondary source · source ↗
The s. 29A cap is uncertain: Chambers 2026 says up to ILS 100,000, which is commonly understood as ILS 50,000, doubled where there was intent to harm. The limitation period is now 7 years for claims arising after 14 Aug 2025.
Scores are our reading on the published rubric, checked 18 October 2026. Not legal advice.
Biblioteca de regulamentações
Todas as leis estaduais de privacidade dos EUA em um só mapa
24 estados têm uma lei abrangente de privacidade na biblioteca, ao lado das leis da UE, do Reino Unido, federais dos EUA e globais: 102 no total, cada uma explicada em linguagem simples com suas fontes. Selecione um estado para ver o que se aplica lá.
- Em vigor
- Entrando em vigor
- Leis setoriais