Amendment 13: what needs to change in your system

What changed in the definitions

• Personal information: any data about a person who can be identified with reasonable effort. That is broader than a name and an ID number.
• Information of special sensitivity: health, genetics, biometrics used for identification, origin, criminal record, political views and religious beliefs, personality assessment, salary and financial activity, location and traffic data, and information subject to a duty of confidentiality.
• A database now means a digital collection. The database owner is replaced by the controller (בעל שליטה), the organization that determines the purposes of processing, while an external processor is called a holder (מחזיק).

Registration and notification

For the private sector, database registration is largely abolished. It remains in place for public bodies and for data brokers with large databases. In its place comes a new duty: notify the regulator within 30 days about a database containing information of special sensitivity on more than one hundred thousand people. The notification includes a database definition document, the same document required under the Data Security Regulations.

For the system, this means knowing how many people are in each database and which fields are stored about them. It sounds obvious, but in a system that has grown over time, the answer usually requires separate work.

Who needs a privacy protection officer

The officer can be an external professional, but according to the regulator's guidance cannot be the CTO or CIO, because they have a conflict of interest. The appointment is reported to the regulator.

The technical measures the regulator will check

The list is taken from the regulator's professional guide to the amendment (in Hebrew) and is based on the Data Security Regulations:

1. A database definition document: what data is included, for what purpose, and who has access.
2. An approved, up-to-date data security procedure.
3. Role-based access management and an access log: who viewed records, and when.
4. Documentation of security incidents and a procedure for reporting serious ones.
5. System separation, timely updates, and protected network connections.
6. Periodic audit and control of suppliers that process the data.
7. For databases at a high security level, a risk survey and a penetration test are also required.

Failing to report a serious incident, missing a required risk survey or penetration test, and lacking control over suppliers fall within the most severe tier of fines. Fines increase with the number of people in the database, and their overall ceiling is tied to annual turnover.

Where systems are usually not ready

• No access log. The system knows who changed a record, but not who opened it. For sensitive data, this is a requirement, not a nice-to-have.
• Roles too broad. Every employee has one role, user, and everyone sees everything.
• Copies have spread. Excel exports, a test environment with real data, an old server that is no longer in use.
• A supplier without a data protection agreement. A cloud service or contractor processes the data, and nothing is documented about what it is required to do.
• AI tools. Customer data is sent to an external model without checking exactly what leaves the system and where it is stored.

What we do

We review the system against the list of technical measures above: what exists, what is missing, what can be fixed through configuration, and what requires development. We build the access log, separate roles, remove real data from test environments, and document the databases. The legal side, including whether you need an officer, is decided by a lawyer; we prepare the system facts for them.

Frequently asked questions

What is Amendment 13?

Amendment 13 to Israel's Privacy Protection Law. It broadened the definitions of personal information and information of special sensitivity, changed database registration, required some organizations to appoint a privacy protection officer, and gave the regulator the power to impose administrative fines.

Do we need to register our database?

For most private companies, registration was abolished. It remains for public bodies and data brokers with large databases. But a database containing information of special sensitivity on more than one hundred thousand people must be notified to the regulator within 30 days.

Who must appoint a privacy protection officer?

Public bodies, holders processing public bodies' databases, data brokers with large databases, and organizations that systematically monitor people or process information of special sensitivity on a significant scale. The officer can be external, but not the CTO.

Which technical measures are required?

A database definition document, a security procedure, access management with a log, incident documentation, system separation, updates, protected connections, audit and supplier control. At a high security level, also a risk survey and a penetration test.

Does this apply to a company that only builds the system for a client?

Yes, if it processes the client's data, which makes it a holder. If the client is a public body, the duty to appoint an officer may also apply to the contractor.