Not legal advice: This article is general information, not legal advice. Israeli privacy law changes over time and applies differently case by case — verify your specific obligations with a qualified lawyer before you rely on anything here.
Amendment 13 to Israel's Privacy Protection Law, 1981, passed the Knesset on August 5, 2024 and took effect on August 14, 2025 — about a year ago as of this writing. The Privacy Protection Authority (PPA) itself describes it as the most comprehensive overhaul of Israeli privacy law since the original 1981 statute, and framed as continuing the alignment with EU privacy standards that let the EU reaffirm Israel's data-adequacy status back in January 2024. It touches almost every business that keeps a database of personal information — which, if you run WhatsApp or email marketing, includes you.
This isn't the same law as Section 30A of the Communications Law — the "Spam Law" covered in our other compliance guide, which governs whether you're allowed to send a specific marketing message. Amendment 13 governs something upstream of that: how you collect, register, secure, and hold the contact database itself. We went through the Privacy Protection Authority's own official guide to the amendment and its direct-mail directive, and cross-checked the specific figures against several Israeli law firms — including one number that gets repeated wrong on more than one international compliance blog.
Key takeaways
- Amendment 13 took effect August 14, 2025. Database registration is now almost entirely abolished for private businesses — it survives mainly for data brokers and direct-mail-list businesses with 10,000+ people in their database, plus public bodies.
- A DPO is mandatory only for specific categories: public bodies, data brokers, large-scale systematic-monitoring businesses (like cellular carriers), and large-scale processors of specially-sensitive data (the law explicitly names banks, insurers and hospitals) — and the DPO can't also be your head of marketing, CFO, IT manager or CTO.
- Administrative fines are no longer flat amounts — they're formulas that scale per contact in your database, and the regulator's own guide gives real worked examples running into the millions of shekels, capped at 5% of the violator's annual turnover per proceeding.
- Civil statutory damages without proof of harm are capped at ₪10,000 per violation — not ₪100,000, a figure we found repeated on more than one international site. The claim window for these suits also grew from 2 years to the general 7-year civil limitation period.
- Messaging your own active customers about your own products, using information they gave you for the service they signed up for, generally isn't "direct mail" under the law's own definition — segmenting them by a trait unrelated to that service is what flips it into a regulated activity.
What does Amendment 13 actually cover, and how is it different from the Spam Law?
Amendment 13 regulates the database itself — how personal information is collected, defined, secured, registered (or not), and deleted on request — regardless of which channel you eventually message someone through. Section 30A of the Communications Law, by contrast, only governs one narrow question: did you get consent before sending a specific commercial email, SMS or WhatsApp message? They're separate statutes that both apply to a typical marketing database at once.
The Privacy Protection Authority's own May 2025 professional guide to the amendment calls it the most significant update to Israeli privacy law since the original 1981 act, built to modernize the statute for AI-era data processing and to keep Israel's EU "adequacy" recognition (last reaffirmed in January 2024) intact. If your business holds a database of customer or lead contact details for WhatsApp or email marketing — which is the entire premise of a CRM — Amendment 13 applies to that database, full stop.
Our WhatsApp compliance guide covers Amendment 13 briefly, from the angle of what counts as valid marketing consent. This guide goes much deeper into the database-level obligations — registration, DPO appointment, security tiers and the real fine structure — which apply whether you message people by WhatsApp, email, or both.
Does your contact list need to be registered as a database?
Almost certainly not, if you're a typical business marketing to your own customers — and this is one of the amendment's biggest simplifications. Before Amendment 13, most databases of any size had to register with the Privacy Protection Authority. That requirement is now abolished for the private sector almost entirely.
Registration survives only for two categories: public-sector databases (other than a database that holds only that body's own employee records), and databases whose main purpose is collecting personal information in order to pass it to others as a business or for payment — explicitly including direct-mail-list services — once that database holds information on 10,000 or more people. A store, clinic or service business that keeps its own customer list to market to those same customers doesn't fall into either bucket, because its main purpose is running the business, not trading data.
| Situation | Registration required? |
|---|---|
| A public body's database (government office, local authority, etc.) | Yes — except a database holding only that body's own employee records |
| A database whose main purpose is collecting personal data to pass to others for business or payment — including direct-mail services — with 10,000+ people | Yes |
| A regular business's own customer or lead list, used to market to those same people (even if it's larger than 10,000) | No, in most cases — but every other Amendment 13 obligation still applies in full |
There's a separate, lighter-weight duty: a database that holds specially-sensitive information (see below) on 100,000+ people, but doesn't meet the registration criteria, must still notify the PPA within 30 days — giving the controller's contact details, the DPO's contact details if one is required, and a copy of the database's security definitions document.
When is a Data Protection Officer (DPO) actually mandatory?
Not for most small marketing lists — but the categories that do trigger it are worth checking against carefully, because the appointment rules are strict once they apply. The PPA's guide sets out four categories: public bodies; data brokers whose main business is collecting personal data to pass to others (including direct-mail services) with 10,000+ people in the database; businesses whose core activity requires ongoing, large-scale systematic monitoring of people — the guide names cellular carriers and search engines as examples; and businesses whose core activity involves large-scale processing of specially-sensitive data, where the law explicitly names banks, insurance companies and hospitals.
If your business does fall into one of these categories, the independence rules are strict: the DPO reports directly to the CEO (or someone who reports directly to the CEO), and can't simultaneously hold a role the guide flags as an inherent conflict of interest — it specifically names the head of marketing, head of customer relations, CFO, IT manager and CTO as roles that generally can't double as DPO.
- Public bodies (ministries, local authorities, health funds, hospitals, universities and similar bodies) — with a separate internal-supervisor regime for security bodies.
- Data brokers / direct-mail-services businesses with 10,000+ people in their database.
- Businesses whose core activity requires large-scale, ongoing systematic monitoring of individuals (e.g. cellular carriers, search engines).
- Businesses whose core activity involves large-scale processing of specially-sensitive data — the law explicitly names banks, insurers and hospitals.
Don't confuse the DPO with the separate "information security officer" role, which is a different, longer-standing requirement mainly aimed at public bodies, banks, insurers, credit-rating companies, and controllers of five or more registrable/notifiable databases. Israeli law firms reported the PPA initially wouldn't enforce the DPO-appointment duty before October 31, 2025 — that window has already closed, so if your business is in one of the four categories, treat it as a live obligation, not a future one.
What counts as "specially-sensitive" information now?
Amendment 13 replaces the old, shorter "sensitive information" category with a much broader "specially-sensitive information" definition — and the category matters well beyond a compliance checkbox, because it's what multiplies several of the fines below, and what triggers the 100,000-person notification duty.
| Category | What it includes |
|---|---|
| Intimate & family life | Family privacy, intimate relationships, sexual orientation |
| Health | Medical condition and records, including under the Patient's Rights Law |
| Genetic and biometric data | Genetic information; biometric identifiers used to identify or verify someone digitally |
| Origin and record | Ethnic origin; criminal record |
| Beliefs | Political opinions, religious beliefs, general worldview |
| Personality profiling | Professional personality assessments — character traits, cognitive ability, work or study performance |
| Money | Salary data and financial activity |
| Location | Location and traffic data from a licensed communications provider, or any location data that reveals one of the other categories above |
A typical marketing database holding names, emails, phone numbers and purchase history usually doesn't cross into this category — but the moment you store health notes, precise location history, or anything from this list, fines for violations involving that data double or more, and the DPO/notification thresholds can apply sooner.
Is a segmented campaign to your own list legally "direct mail"?
This is the question the law's own direct-mail directive (updated for Amendment 13) answers directly, and it's more forgiving than most marketers assume. "Direct mail" under Section 3 of the law is a personal message sent to someone because they belong to a population group defined by one or more characteristics of the people named in a database.
The Authority's directive draws a specific line: when a business messages its own active customers using information those customers gave it for the service they actually signed up for — without building a new profile beyond what that service requires — it isn't "direct mail" at all. The directive's own example: labeling a bank account as a "soldier account" or "pensioner account" to deliver the right service doesn't count, because that classification comes from the service itself, not from profiling. The moment you segment by a trait that has nothing to do with the service — the directive's example is a supermarket chain messaging customers who belong to a particular religion ahead of that religion's holiday — it becomes direct mail, and the extra obligations below kick in.
| Scenario | Is it "direct mail"? |
|---|---|
| A general promotion sent to all your active customers, without slicing them by an unrelated trait | No |
| A bank tagging an account "soldier account" or "pensioner account" to deliver the matching service | No — the classification comes from the service itself |
| A supermarket chain messaging customers who belong to a particular religion ahead of that religion's holiday | Yes — the segmentation isn't tied to the service |
| Buying, renting, or otherwise obtaining a contact list from someone else's database | Yes, always |
When something does qualify as direct mail, every message has to clearly disclose: that it's direct mail; the database's registration number, if it's a registered direct-mail-services database; the recipient's right to be deleted, and where to send that request; and the controller's identity, address and the source the data came from. A deletion request has to be honored within 30 days, or the recipient can take it to court.
What does a real violation actually cost — the formula behind the fines
Amendment 13 replaced Israel's old flat administrative-fine mechanism with formulas that scale per person in your database, and the PPA's own guide walks through worked examples that make the scale obvious fast. The heaviest bracket applies to failing to give the required disclosure when collecting data or sending direct mail: ₪50 per person contacted, or ₪100 per person if the information is specially-sensitive, with a ₪30,000 floor per violation.
| Scenario from the PPA's guide | People affected | Resulting fine |
|---|---|---|
| Collecting specially-sensitive data from 5,000 people without the required disclosure | 5,000 | ₪500,000 |
| Processing data beyond the controller's authorization, in a database holding specially-sensitive info | 200,000 | ₪1,600,000 |
| A public body with no DPO, holding specially-sensitive data | 100,000 | ₪400,000 |
| Collecting data from an unspecified group (e.g. via a website form) without disclosure, involving specially-sensitive info | 500,000 | ₪2,000,000 |
≤ 5%
the maximum a single PPA enforcement proceeding may fine a business, as a share of its annual turnover — regardless of how the itemized per-violation fines add up. Separate, lower caps apply to small businesses (₪4M–10M annual turnover) and micro businesses (under ₪4M).
Source: Privacy Protection Authority's official Amendment 13 guide (May 2025)
Missing disclosure at collection / direct mail
Unlawful processing
Missing DPO / direct-mail record-keeping
The Authority can reduce a fine by up to 70% total for mitigating factors — stopping the violation and self-reporting it earns a flat 30% off on its own, and a clean record on that same type of violation for the past 3–5 years earns another 10–20%.
How much can someone actually sue you for — and is ₪100,000 real?
No — and this is the specific number we found repeated, wrongly, on more than one international compliance blog. Amendment 13 lets a court award damages without proof of harm for a specific list of violations — including running a registration-required database unregistered, collecting data without the required disclosure, denying someone access to their own information, or not notifying someone that their correction or deletion request was carried out. The statutory ceiling for these claims is ₪10,000 per violation, confirmed independently by multiple Israeli law firms and by Calcalist's reporting on the amendment — not ₪100,000.
≤ ₪10,000
the statutory ceiling an Israeli court may award per Amendment 13 violation without proof of harm — not the ₪100,000 figure that circulates on some international compliance sites.
Source: Privacy Protection Law (Amendment 13), as summarized by the Herzog law firm, the o-n.law firm, and Calcalist's August 2025 reporting
What did genuinely get bigger: the claim window. The old 2-year shortened limitation period for Privacy Protection Law civil claims is gone — it now follows the general 7-year (or longer) civil limitation period, for causes of action arising after August 14, 2025. And a ₪10,000 civil award and a PPA administrative fine aren't mutually exclusive — a single incident can trigger both.
What should every database owner actually do, regardless of size?
- 1Confirm whether your database needs to register (data-broker/direct-mail-services businesses with 10,000+ people, or public bodies) or just notify the PPA within 30 days (100,000+ people with specially-sensitive data) — most marketing lists need neither, but every other duty below still applies.
- 2Update your data-collection disclosure: beyond the purpose of collection, you now also have to state whether providing the data is mandatory or a choice (and the consequence of refusing), plus the existence of access and correction rights.
- 3Stop processing any data you know — or should reasonably know — was collected unlawfully by whoever handed it to you; the blanket ban on processing illegally-sourced information is new in Amendment 13.
- 4Honor access, correction and deletion requests within 30 days, and keep a written log of when and how you responded — this is your defense if a claim or PPA inquiry follows.
- 5If you're genuinely unsure whether a specific database or campaign triggers registration, DPO or notification duties, the PPA accepts advance-opinion requests before you build it.
In oToK, every contact lives as one record with its own tags and fields, and consent or opt-out status applies across every list and automation from that single record — which makes it easier to keep an accurate, exportable log of what data you hold and why. That's a practical aid, not a substitute for actually classifying your database and meeting Amendment 13's obligations yourself.
Frequently asked questions
- I only message my own existing customers about my own products — does Amendment 13 even apply to me?
- Yes, but selectively. The security, disclosure and access-rights duties apply to any database of personal information, regardless of who you message. The direct-mail-specific chapter (extra disclosures in every message, the registration duty tied to direct-mail services) generally doesn't apply, though, if you're messaging your own active customers using information they gave you for the service they signed up for, without segmenting by a trait unrelated to that service.
- Do I need to register my contact database with the Privacy Protection Authority?
- Almost certainly not, if you're a typical business marketing to your own customer list — private-sector registration was nearly abolished by Amendment 13. It survives mainly for public bodies and for businesses whose main line of work is collecting personal data to pass to others for money, including direct-mail services, once that database holds 10,000+ people.
- Do I need to appoint a Data Protection Officer (DPO)?
- Only if your business falls into one of four categories: a public body, a data broker or direct-mail-services business with 10,000+ people in its database, a business whose core activity requires large-scale systematic monitoring of people, or a business whose core activity involves large-scale processing of specially-sensitive data (the law names banks, insurers and hospitals explicitly). If none of those describe you, a DPO isn't mandatory.
- Is ₪100,000 really the maximum someone can sue me for under Amendment 13?
- No — that figure is a commonly repeated error. The actual statutory ceiling for damages without proof of harm is ₪10,000 per violation, confirmed by multiple Israeli law firms and by Calcalist's reporting on the law. What did change meaningfully is the claim window, which grew from a shortened 2-year period to the general 7-year civil limitation period.
- How is Amendment 13 different from Israel's Spam Law (Section 30A)?
- They're separate statutes covering different things. Section 30A (covered in our email compliance guide) governs one narrow question — did you get consent before sending a specific commercial email, SMS or WhatsApp message? Amendment 13 governs the database itself: how you collect, define, secure, register and delete personal information, independent of which channel you eventually message someone through. A typical marketing database has to satisfy both at once.
