Amendment 13 vs. GDPR:
What Israeli and International Companies Should Understand
Israel’s privacy regulatory environment is changing. Amendment 13 to Israel’s Privacy Protection Law is one of the most significant updates to Israeli privacy law since the original law was enacted in 1981.
It updates key definitions, strengthens the role and enforcement powers of the Israeli Privacy Protection Authority, introduces new privacy governance obligations, changes the database registration model, expands notice requirements, increases financial enforcement exposure, and creates new expectations around privacy leadership and data security.
Advisory Disclaimer
This is practical advisory content, not legal advice. Amendment 13 is not GDPR. GDPR readiness may help, but does not automatically mean Israeli privacy readiness. VULNSEE does not replace legal counsel.
For Israeli companies, this is not a theoretical legal update.
It changes how organizations should think about privacy governance, cybersecurity controls, evidence, vendor oversight, DPO responsibilities, and management accountability.
For international companies entering Israel, the question is even more important: If we are already GDPR-ready, are we ready for Israeli privacy law?
The answer is: not automatically.
GDPR readiness can be a strong foundation, but it does not replace a local Israeli privacy readiness assessment. Amendment 13 and GDPR share several governance themes, but they are not the same framework, and they should not be treated as interchangeable. This article explains the practical overlap, the important differences, and what companies should do next.
Why this matters now
Many organizations operating in Israel now face a more serious privacy and cybersecurity governance environment. This includes:
- Israeli companies preparing for Amendment 13
- public-sector organizations
- vendors selling into the Israeli public sector
- fintech and financial services companies
- banks and payment companies entering Israel
- insurance companies
- healthcare and healthtech companies
- SaaS providers processing Israeli user data
- AI companies using personal data
- HR and workforce platforms
- cloud and technology vendors
- international companies opening Israeli operations
- companies serving regulated Israeli customers
The practical issue extends beyond whether the law applies. The stronger business question is:
Can the organization prove that personal data is understood, governed, secured, documented, and managed with clear ownership?
That is where Amendment 13 becomes a board-level and management-level issue.
Amendment 13 in one sentence
Amendment 13 modernizes Israeli privacy law by moving organizations away from a narrow database-registration mindset and toward a more mature model of privacy governance, accountability, security, enforcement, and evidence.
It does not turn Israeli privacy law into GDPR. But it does make the comparison more relevant than ever.
Amendment 13 vs. GDPR: High-Level Comparison
| Topic | Amendment 13 / Israeli Law | GDPR |
|---|---|---|
| Legal framework | Israeli privacy law, enforced by the Israeli Privacy Protection Authority. | EU privacy regulation enforced by EU supervisory authorities. |
| Main direction | Modernization of Israeli privacy law, stronger enforcement, updated definitions, DPO duties for certain organizations, database governance, security enforcement. | Comprehensive EU privacy framework focused on lawful processing, transparency, rights, accountability, security, processors, transfers, and enforcement. |
| Personal data | Updated definition of personal information and specially sensitive information. | Broad definition of personal data and special categories of personal data. |
| Public sector | Public bodies are directly within the category of organizations required to appoint a DPO, with separate treatment for certain security bodies. | Public authorities and bodies are generally within DPO appointment requirements under GDPR rules. |
| DPO | Required for public bodies and certain private-sector organizations with higher privacy risk. | Required in specific cases, including public authorities, large-scale monitoring, and large-scale processing of special category data. |
| Registration / notification | Broad database registration is reduced, but certain databases may still require registration or notification to the Authority. | GDPR focuses on accountability, records of processing, governance, and documentation, not the Israeli registration model. |
| Security | Strong connection to Israeli Data Security Regulations and enforcement. | Requires appropriate technical and organizational measures and breach handling. |
| Enforcement | Expanded administrative enforcement and financial sanctions under Israeli law. | Significant administrative fines under GDPR. |
Public-sector organizations: DPO is not optional
One of the clearest changes under Amendment 13 is the treatment of public-sector bodies. Public bodies fall directly within the category of organizations required to appoint a Data Protection Officer. Certain security bodies are subject to a separate privacy supervision arrangement.
This point matters beyond the public sector itself.
If your company sells technology, SaaS, cloud services, consulting, financial services, data platforms, AI systems, healthcare platforms, HR tools, or managed services to Israeli public-sector customers, the customer’s privacy obligations may affect you indirectly.
Public-sector customers may ask stronger questions about data access control, vendor security, data retention, subcontractors, evidence of controls, and privacy leadership involvement. A vendor may not be a public body itself, but it may still need to satisfy public-sector procurement expectations.
Foreign companies entering the Israeli market
International companies entering Israel should also understand Amendment 13. This is especially relevant for European banks opening activity in Israel, UK or EU fintech companies serving Israeli customers, global SaaS companies onboarding Israeli organizations, and companies serving regulated entities.
A company may already have a GDPR program. It may already have a DPO, records of processing, privacy notices, vendor agreements, and security controls. That is useful.
But the company still needs to ask whether its existing privacy operating model is mapped to Israeli requirements. GDPR readiness can reduce the starting gap. It should not be treated as automatic Israeli readiness.
Where Amendment 13 moves closer to GDPR-style governance
1. Privacy becomes governance, not paperwork
The organization now needs to understand what personal data it processes, what notices are given, who has access, how security controls are implemented, and who owns privacy governance internally. This is similar to the GDPR mindset of accountability.
2. DPO and privacy leadership become more important
Both GDPR and Amendment 13 create situations where a DPO may be required. A serious DPO function should connect privacy law, data mapping, security controls, employee awareness, and vendor oversight.
3. Reduced registration does not mean reduced responsibility
While broad database registration is reduced for many, all other obligations (notification, securing systems, manage vendors, prepare evidence) still apply. The focus shifts from registration to governance.
4. Enforcement becomes more material
Expanded enforcement tools turn privacy from a legal policy issue into a management risk issue, similar to the shift Europe experienced with GDPR.
5. Privacy and cybersecurity become harder to separate
Under both laws, privacy cannot be separated from information security. Privacy documentation without security controls is weak, requiring regular cyber risk assessments and strong CISO alignment.
How GDPR-ready companies should localize for Israel
International companies should localize their privacy program using the following steps:
- Map GDPR records: Review whether existing records of processing support Israeli database definitions and notification analysis.
- Review DPO triggers: Determine whether Israeli DPO appointment duties apply.
- Review privacy notices: Check if collection points meet Israeli notice expectations.
- Map security controls: Review measures against Israeli data security expectations.
- Review vendor arrangements: Identify subcontractors touching Israeli personal data.
- Prepare evidence: Build a readiness file with policies, data maps, and security evidence.
- Update incident response: Reflect Israeli escalation and notification expectations.
- Define local ownership: Decide who owns Israeli privacy and security governance.
What leadership should ask
Executive teams should ask:
- Do we know what personal data we process and which systems are involved?
- Do we process specially sensitive information?
- Do we need a DPO under Israeli law, GDPR, or both?
- If we sell into the Israeli public sector, are we ready for privacy and security due diligence?
- What would we show a regulator, customer, auditor, investor, or board tomorrow?
If leadership cannot get clear answers, the organization needs a readiness plan.
How VULNSEE Helps
VULNSEE helps Israeli and international organizations prepare for privacy, cybersecurity, and compliance expectations through practical advisory and execution support. We help organizations translate privacy obligations into operational controls, evidence, governance, and risk-based execution.
Executive Takeaway
Amendment 13 is not GDPR. But it moves Israeli privacy law closer to a governance, accountability, enforcement, and evidence-based privacy model.
For Israeli organizations, this is a readiness moment. For international companies entering Israel, this is a localization moment. For vendors selling into the Israeli public sector or regulated industries, this is a trust moment. The companies that prepare properly will be able to show customers, regulators, boards, and partners that privacy risk is understood, owned, controlled, and evidenced.
Frequently Asked Questions
Is Amendment 13 the same as GDPR?
No. Amendment 13 is an Israeli amendment to Israel’s Privacy Protection Law. GDPR is an EU regulation. They share governance themes, but they are not identical and should not be treated as interchangeable.
Does GDPR readiness help with Amendment 13 readiness?
Often, yes. GDPR readiness may provide a strong foundation through data mapping, DPO processes, privacy notices, vendor controls, security governance, and evidence. However, Israeli privacy law still needs to be assessed separately.
Do public-sector organizations in Israel need a DPO?
Public bodies are directly within the DPO obligation category under Amendment 13, while certain security bodies are subject to a separate privacy supervision arrangement.
Do private companies in Israel need a DPO?
Some private-sector organizations may need a DPO, depending on their activity, data scope, processing type, and privacy risk. Companies should assess the obligation based on their specific context.
Should foreign companies entering Israel review Israeli privacy law?
Yes. International companies entering Israel, serving Israeli customers, processing Israeli personal data, or selling into Israeli public-sector or regulated customers should assess how Israeli privacy law applies to their activity.
Can a GDPR DPO also cover Israeli privacy obligations?
Possibly, but it should be reviewed carefully. The organization should consider Israeli legal knowledge, role scope, reporting line, independence, conflict-of-interest issues, and whether the DPO has enough resources.
What is the biggest operational impact of Amendment 13?
The biggest impact is the shift toward stronger governance, enforcement, evidence, and accountability. Organizations need to understand their data, document controls, manage vendors, and prepare for privacy and security review.
What should companies do first?
Start with data and database mapping. Identify what personal data is processed, where it is stored, who can access it, which vendors are involved, and what controls and documentation already exist.
Can VULNSEE help international companies entering Israel?
Yes. VULNSEE supports international companies entering Israel through privacy readiness assessment, DPO advisory, Israeli regulatory mapping, security control review, GRC, vendor risk review, and evidence preparation.
Need clarity on your Amendment 13 readiness?
Assess your gap to Israeli privacy law, map your controls, and establish defensible privacy governance.
CONTACT ADVISORRelated Advisory
