Privacy Law Amendment 13: What Small Offices and Non-Profits Should Check Now

Amendment No. 13 to Israel's Privacy Protection Law has been in force since 14 August 2025. It is one of the biggest changes to the law since it was first passed, and the Privacy Protection Authority supervises how it is applied. At Oz-Tal we hear a lot of questions about it from accounting firms and law offices, schools, yeshivas and non-profits. So we've put together a plain-language summary of what has changed and what is worth checking.

What has changed, broadly

The amendment updates the law's basic definitions. "Personal information" is now defined broadly as any data relating to a person who is identified or can be identified. "Processing" is also defined broadly, and covers collecting, storing, copying, viewing and giving access to information. In other words, almost any office that keeps a client list, student files or donor details is handling personal information.

The amendment also narrows the duty to register databases, requires certain organisations to appoint a Data Protection Officer (DPO), and gives the Authority wider supervision and enforcement powers, including a system of financial sanctions. Keep in mind that a database that no longer has to be registered is still subject to all the other duties in the law and its regulations, including the information security requirements.

Five checks worth making in your office

1. Who can access what. An up-to-date list of who has access to folders, software and systems. An employee who has left, or a volunteer who has finished, should no longer have access.
2. Two-factor authentication (2FA). On email, on remote access, and on any system that holds information about people. A password on its own is no longer enough.
3. Offsite backup. An up-to-date copy of your data that is kept outside the office and disconnected from the everyday network, so that a fault or a ransomware attack can't reach it too.
4. EDR protection on your computers. Protection that detects suspicious behaviour on workstations and servers, not just known files.
5. A written procedure. A simple document that sets out who is responsible for what, how access is granted and removed, and what to do when an incident happens.

None of these calls for a huge project. Most offices already have some of them in place, and just need to close the gaps and document them.

Remember that outside suppliers who handle information for you, such as an external bookkeeper, a cloud system or an IT company, are part of the picture too. It's worth knowing which of them touch your data, and how much.

How we can help

We've put together a fixed-price compliance package that starts with a gap survey. We come in, review your current setup against the points above, and give you a clear report of what's in order, what's missing and what to tackle first. You can then implement the fixes with us, from setting up 2FA to managed backup and EDR protection, with no surprises on the price.

Oz-Tal has been supporting offices and organisations in Jerusalem since 1997, and we know the needs of small offices, educational institutions and organisations in the religious community well.

Let's talk

Want to know where you stand? Call us on 02-500-2022 (Sun–Thu, 09:00–16:00), or leave your details on the website and we'll get back to you to schedule a gap survey.

Please note: this article gives a general overview and is not legal advice. For legal questions about your organisation's obligations, please consult a lawyer. Official information is published on the Privacy Protection Authority's website.