Must a company report a data breach to Israel's Privacy Protection Authority?

The Regulations sort every database into one of four security tiers according to its size, sensitivity and the number of people who can access it, and the reporting duty attaches at the medium and high tiers. A severe incident means unauthorized use or copying of a substantial part of the database, or damage to its integrity where the tier is high, rather than a routine failed login. The report goes to the Privacy Protection Authority, which then decides whether the affected individuals must be told and may require the company to publish that notice. Running alongside the reporting duty are record-keeping obligations: an incident log, a documented response, and a periodic review of the security arrangements, all producible on demand.

Foreign companies most often trip on speed and language rather than on substance. The Israeli trigger is immediate reporting, not a 72-hour window, so a legal team pacing itself against the European clock is already late by the time it files. Name someone before an incident who can prepare and submit the report in Hebrew, and keep a standing incident log rather than reconstructing events afterwards. Compliance with the GDPR does not discharge the Israeli duty, because the two regimes define the trigger, the recipient and the timing differently, and our guide to Israeli data protection law for businesses sets out the wider framework a foreign controller has to meet.

From the full guide: Israel Data Protection Law for Businesses

← Browse all Q&A