On 5 August 2024 the Knesset approved Amendment No. 13 to the Privacy Protection Law, 5741-1981, which entered into force on 14 August 2025. The amendment added Sections 17B1 to 17B3, which set out who must appoint a Privacy Protection Officer (Data Protection Officer, DPO), what the officer’s duties are, and what is required of the officer. On 14 July 2026 the Privacy Protection Authority published an opinion on appointing the officer, interpreting these provisions. On the officer’s role where the organization uses artificial intelligence tools, see the separate article.

The officer’s role is to work towards compliance with the Law and its regulations, and to promote privacy protection and information security in the organization’s databases. The officer does not replace the information security officer, an appointment the Law required before the amendment.

Section 17B1(a) of the Law lists four groups:

Under Section 17B1(b), whether processing is on a “significant scale” depends on the number of people whose data is processed, their proportion of the population, the volume and variety of the data, the duration and frequency of the processing, the retention period, and the geographic scope of the processing. According to the opinion there is no numerical threshold. For a processor serving many customers, the scale is assessed cumulatively across all customers. The opinion’s example is a processor handling data for 1,000 databases, each holding data of special sensitivity on only 100 people. Systematic monitoring is particularly relevant to tracking user activity and profiling for targeted advertising, content personalization, credit scoring, insurance underwriting and fraud detection.

“Data of special sensitivity” was redefined by Amendment 13. Among other things it includes health data, genetic data, biometric identifiers, criminal records, political opinions and religious beliefs, personality assessments, salary and financial activity data, and data subject to a statutory duty of confidentiality. Organizations that are not banks or insurers, such as private clinics, payroll companies and diagnostic institutes, should therefore consider whether they fall into group (4).

Section 17B2 sets out the officer’s duties:

• To serve as a professional authority and knowledge center and to advise the organization’s management on privacy protection.
• To prepare a privacy training program and supervise its implementation.
• To prepare a plan for ongoing monitoring of compliance with the Law and regulations, ensure it is carried out, report the findings to management and propose corrections.
• To ensure that an information security procedure and a database definitions document exist under the Privacy Protection (Data Security) Regulations, 5777-2017, and that they have been submitted to management for approval.
• To ensure that requests from data subjects concerning the processing of their data and the exercise of their rights, including access and correction requests, are handled.
• To act as the contact person with the Privacy Protection Authority. The officer’s contact details are published to the public.

According to the opinion, the officer should also be involved in decisions on acquiring and upgrading information systems, and is advised to promote privacy impact assessments. The organization is not required to adopt the officer’s position, and the officer bears no personal liability for the organization’s non-compliance.

Under Section 17B3, the officer must have the knowledge and skills required for the role, having regard to the nature, circumstances, scope and purposes of the organization’s data processing. The Law specifies three areas: in-depth knowledge of privacy law, an adequate understanding of technology and information security, and familiarity with the organization’s activities and objectives.

The officer reports directly to the chief executive or to someone who reports directly to the chief executive. The organization must provide the conditions and resources the role requires and ensure the officer is involved in every matter concerning privacy protection. The officer may not hold another position that could create a conflict of interest, and may not be subordinate to anyone who could place the officer in such a position. Senior positions such as head of marketing, chief financial officer, head of information systems or chief technology officer usually raise a concern of conflict of interest.

The Law permits the appointment of an external officer as a service provider. An external officer serving several organizations is subject to the same requirement and may not be subordinate, in another organization, to anyone who could place the officer in a conflict of interest.

The information security officer is appointed under Section 17B of the Law. After Amendment 13 the duty to appoint one applies to public bodies; to banks, insurance companies and companies engaged in credit rating or credit assessment; and to anyone who holds or controls five databases subject to registration or notification to the Authority. The information security officer bears responsibility for security; no similar responsibility was imposed on the privacy officer.

The Law does not expressly prohibit one person from holding both positions. The requirements of legal knowledge, reporting to the chief executive and avoiding conflicts of interest make this difficult, especially in a large organization.

Amendment 13 empowered the Privacy Protection Authority to impose administrative fines. With respect to the officer:

For example, a public body that has not appointed an officer, with a database holding data of special sensitivity on 100,000 people, is exposed to a fine of NIS 400,000. Where an organization required to appoint an officer has actually done so, and is not a public body or a data broker, the Authority may, at its request, reduce by 10% a fine imposed for another violation.

Article 37 of the EU General Data Protection Regulation (GDPR) requires the appointment of a DPO by a public authority, by an organization whose core activities consist of regular and systematic monitoring of individuals on a large scale, and by an organization whose core activities consist of large-scale processing of special categories of data or data on criminal convictions. Groups (1), (3) and (4) in the Israeli Law follow the same structure. The data broker group is unique to Israeli law. An Israeli company that is also subject to the GDPR examines its duty to appoint under each law separately.