What are the penalties for non-compliance with Israeli data protection law?

Criminal penalties under the Privacy Protection Law include fines and, for serious intentional violations, imprisonment of up to five years. Operating an unregistered database that requires registration is a criminal offence. Civil liability can arise from any unlawful violation of the Law — data subjects may sue for damages without proving actual financial loss. The PPA can also direct corrective actions and publish enforcement findings, which carry reputational consequences. Proposed amendments would introduce significantly higher administrative fines.