Amendment 13: the technical work your lawyer cannot do for you
We map the personal data in your systems, review access rights, encryption and access logging, and fix what is missing in the code and infrastructure.
In short
Amendment 13 to Israel's Privacy Protection Law has been in force since August 14, 2025. The first monetary sanction under it was imposed on July 21, 2026 on a healthcare organization, and not for the breach itself but for reporting a serious security incident late. The legal and organizational side is handled by your lawyer and your privacy protection officer. Alongside that, a large part of the requirements needs technical implementation in the systems: access management, encryption, access logging, data deletion and security incident detection.
Why now
On July 21, 2026 the Privacy Protection Authority imposed the first monetary sanction under Amendment 13, on a healthcare organization. According to the Authority, the organization knew about a serious security incident and reported it only about two months later. Where the duty to report a serious security incident applies, the report is due once the incident becomes known, without waiting for all checks to finish.
What this means for your system: you need to detect security incidents as early as possible, understand which data may have been exposed, and have the information needed for an initial report in time. Access logs and monitoring help detect incidents and establish their scope.
What the amendment requires, definition by definition, is set out on the Amendment 13 for systems page.
What we do
- Technical mapping: which tables, files, backups and external services contain personal data.
- Access rights: who can see what, stale accounts, overly broad permissions.
- Encryption and secrets: sensitive data at rest and in transit, passwords and keys left in the code.
- Access logging: whether you can tell who accessed the data, when, and which part of the system.
- Incident detection and reporting: whether you would discover a security incident in time, and where you would find out what was exposed so you can report to the Authority without delay.
- Retention and deletion: whether there is a mechanism to delete data that is no longer needed.
- Vendors and AI: which personal data is sent to cloud services and external AI services.
- Fixing: we make the changes in the code and infrastructure, not just write recommendations.
What you get
A technical gap report you can hand to your lawyer, your privacy protection officer and your information security officer, plus a remediation plan ordered by priority.
Experience with sensitive data
The national healthcare platform we design and develop has been running in production since 2008. Medical and personal data is our everyday work.
Good to know
We are not a law firm and do not provide legal advice. On legal questions, including whether you must appoint a privacy protection officer, consult a lawyer. We provide them with the technical facts about the systems.
Frequently asked questions
Does this replace a privacy protection officer?
No. We give the officer the technical picture and make the fixes in the systems.
What does a system need to report an incident in time?
Access logs that let you tell who accessed the system and the data, and when, a monitoring system that alerts on unusual activity, and a procedure that sets who is responsible for assessing an incident's severity and for reporting it. Without these tools and processes it is harder to detect incidents in time, establish their scope and report as required.
Our system was built by another vendor. Can you still do this?
Yes. We need access to the code, the database, or at least a test environment.
Does this include a penetration test?
No. We prepare the system for a penetration test and, after it, fix the findings in the code and infrastructure.
SLAtech LTD