Amendment 13 to Israel's Privacy Law: What It Means for Your Servers

Short version: Amendment 13 to Israel's Protection of Privacy Law was approved by the Knesset on 5 August 2024 and took effect in August 2025. It broadens what counts as personal data, tightens disclosure duties, requires some organisations to appoint a Data Protection Officer, gives the Privacy Protection Authority far wider enforcement powers, and lets courts award compensation without proof of damage. Meeting it takes more than paperwork: you need infrastructure that controls access, logs activity, encrypts data and can prove all of this to a regulator.

What is Amendment 13 and why does it matter?

The Protection of Privacy Law, 5741-1981, has been the basis for protecting personal information in Israel for decades. Cloud computing, large-scale data processing and the growth of digital information left much of the original law out of date.

Amendment No. 13 creates a modern framework for managing personal data and brings Israel in line with the world's leading privacy laws, above all the European GDPR.

What are the key new requirements?

To see how a cloud provider can help you comply, start with what the amendment actually changes:

• Broader definitions (section 7). "Personal information" now covers any data that identifies a person directly or indirectly, including digital identifiers. "Sensitive information" includes, among other things, medical, political, genetic and financial data.
• A stronger duty to inform (section 11). Collecting data requires clear disclosure of the purpose of processing, the identity of the controller, the data subject's rights and the consequences of refusing to provide the data.
• A Data Protection Officer (section 23I). Large organisations, public bodies and holders of large sensitive databases must appoint a DPO to oversee compliance.
• Wide enforcement powers (sections 31–34). The Privacy Protection Authority can carry out surprise audits, demand documents, issue administrative orders and pursue criminal proceedings.
• Compensation without proof of damage (section 29A). Courts can award up to ₪10,000 even where no actual damage is shown.
• New criminal offences (section 8C). Processing personal data without authorisation can carry up to three years in prison.

How can your cloud infrastructure help you comply?

For many organisations, Amendment 13 creates a new reality: you need processes, tools and infrastructure that give you full control over data, protect your users' privacy and let you prove compliance to the regulator.

omc.cloud runs Israeli and international cloud infrastructure built from the ground up to strict information-security and regulatory standards, including ISO 27001, ISO 27017 and SOC 2. Customers who host their systems and data with omc.cloud start from a technical and organisational base that already supports compliance.

1. Precise access and permission management

The law requires access to sensitive data to be limited to authorised people. On omc.cloud you can:

• Create users and granular, role-based permissions.
• Log every access, change and action in the system.
• Show the regulator who accessed which data and when, a critical requirement under the enforcement sections.

2. Transparency and oversight

Meeting the duty to inform takes more than forms. It needs systems that produce reports and records. omc.cloud's infrastructure includes:

• Full audit logs that record access to and use of data.
• Custom reports that give you clear data on information use for internal or external reporting.
• Real-time alerts for unusual access or intrusion attempts.

3. Information security to international standards

Amendment 13 does not dictate a specific technology, but it does require "appropriate" protection of personal and sensitive data. omc.cloud provides:

• Encryption in transit (TLS 1.2/1.3) and at rest (AES-256).
• Smart firewalls, a WAF and DDoS protection.
• A 24/7 human NOC that monitors threats and alerts and handles incidents with the customer in real time.
• Compliance with ISO 27001, ISO 27017 and GDPR, standards that Israeli regulators also recognise.

4. Backup and disaster recovery

Business continuity is a core part of protecting personal data. omc.cloud customers get:

• Daily or weekly backups, as you choose.
• Fast data recovery after a cyber incident or failure.
• A wide spread of data centers that back each other up, keeping you redundant and running even if one site goes down physically.

5. Support for your DPO

Appointing a DPO is the organisation's own obligation, but omc.cloud provides:

• Management and documentation tools that form the basis of the DPO's work.
• Guidance and consulting through certified partners, to help you prepare.
• Infrastructure that is ready to demonstrate compliance in regulatory audits.

6. Less exposure to fines and lawsuits

An environment that does not meet the standards exposes you to fines, class actions and reputational damage. Working with omc.cloud lets you:

• Show the regulator and your own customers that your technology "home" is secure and compliant.
• Reduce the risk of compensation claims without proof of damage (section 29A).
• Build privacy management into your IT as an orderly, ongoing process.

Frequently asked questions

When did Amendment 13 take effect?

It was approved by the Knesset on 5 August 2024 and came into force in August 2025.

Does every organisation have to appoint a DPO?

No. The obligation applies to large organisations, public bodies and those holding large databases of sensitive information.

Can I be sued even if no one suffered damage?

Yes. Under section 29A, courts can award up to ₪10,000 without proof of actual damage.

Does hosting on a certified cloud make me compliant?

Not on its own. Compliance remains your organisation's responsibility, but certified infrastructure with access control, logging, encryption and backups gives you the technical base the law expects.

Conclusion

Amendment 13 changes how Israeli organisations are held accountable for personal data. The new requirements are not just legal paperwork: they call for real technical capabilities, transparency, information security and risk management. omc.cloud gives you cloud infrastructure aligned with the law, management and security tools that let you meet its sections in practice, and a technical foundation that reduces your legal exposure. In the era of Amendment 13, choosing a professional, secure cloud is not only a technology decision. It is a strategic step for legal, regulatory and reputational protection.