Amendment 13 to the Israeli Privacy Protection Law — what does it mean in practice?

The amendment substantially expanded the Privacy Protection Authority's enforcement powers and raised the financial penalties that can be imposed. Alongside that it sharpened duties that already existed but were barely enforced — chiefly the duty to secure personal information in a manner proportionate to its sensitivity, and the duty to report serious security incidents.

In practice, much of what the amendment requires was already written into the 2017 Privacy Protection (Information Security) Regulations. What changed is the likelihood that somebody checks.

Almost every organisation. If you hold information about customers, employees or job applicants, you are operating a database, even if you never thought of it in those terms.

The extent of the duties varies with the sensitivity of the information and its volume. Medical information, financial information and information about personal circumstances are treated as especially sensitive, and the requirements around them are stricter.

Some organisations are also required to appoint a privacy protection officer. Whether that applies to you depends on the nature of the activity and the volume of data, and it is a question to settle with a lawyer rather than infer from an article.

Three questions worth being able to answer, because they are exactly what gets asked after an incident.

What do you hold, and where? A map of the personal information you hold, where it sits and who reaches it. Most organisations discover systems at this stage that they did not know held data.

How would you know something happened? Without monitoring and access to logs, you depend on somebody telling you — and a late report of an incident is itself a problem.

What can you show? Not what you did, but what you can demonstrate you did. That is the difference between an organisation that handled things properly and one that can also show it handled things properly.

Not by buying a product. Start with mapping — what is held, where, and who reaches it. A risk assessment does exactly this, and its output is also a document you can produce.

The decisions follow from there: what needs encrypting, where permissions need narrowing, how long to retain logs, and what is monitored.

That order matters. An organisation that buys tools before mapping usually protects what it already knew about very well, and what it did not, not at all.