Privacy & data protection
Outsourced DPO under Israel's Amendment 13
Amendment 13 to Israel's Privacy Protection Law took effect in August 2025, and in July 2026 the Privacy Protection Authority published its final opinion on appointing a Data Protection Officer. If you know the GDPR, the shape will be familiar — but the Israeli requirements are their own, and compliance with one does not establish compliance with the other.
I serve as an outsourced DPO for organizations that need the role to function in practice: mapping the databases, writing procedures people actually follow, training, handling data subject requests, and an annual report a board can read.
Who must appoint a DPO
The obligation applies to four groups:
| Who | Explanation |
|---|---|
| Public bodies | Authorities, statutory corporations and directed bodies |
| Data brokers | Organizations whose business involves data on 10,000 people or more |
| Systematic monitoring | Organizations whose core activity involves systematic monitoring of individuals |
| Sensitive data at significant scale | Database owners and holders whose core business is processing sensitive data |
The point that surprises foreign counsel most: "significant scale" has no numeric threshold. The Authority weighs a set of criteria — the number of data subjects and their share of the population, the volume and variety of the data, the frequency and duration of processing, the retention period and the geographic spread — and a single criterion can be enough to trigger the obligation. A small database can require an appointment.
The practical consequence: an organization that assumed it was exempt because of its size needs to revisit that assumption and document the analysis. Deciding not to appoint is also a decision you have to be able to explain.
What the Authority requires of the DPO
- Independence and reporting line. The DPO reports directly to the CEO, must not hold a role with authority to set data processing policy, and must not report to someone who does.
- No conflict of interest. The Authority identifies structural overlap with the CISO, CFO and marketing roles. The final text softened the draft: it requires a documented case-by-case analysis rather than a blanket disqualification.
- Professional competence. Deep command of Israeli law — statute, regulations, case law, Authority guidance and sector rules — together with technological and security understanding. No academic degree is required; competence is demonstrated through substantial practical experience.
One structural point worth knowing: the DPO must be a natural person. A company cannot be appointed.
When outsourcing is the right model
The opinion expressly permits both models: an internal employee or an external service provider. It notes that a full-time internal appointment is generally advantageous, because of the depth of familiarity with the organization.
That advantage is real, so it is worth saying plainly when outsourcing fits and when it does not:
| Outsourcing fits when | Outsourcing fits less well when |
|---|---|
| The obligation applies but the workload does not justify a role | The organization processes sensitive data at scale, daily |
| Every internal candidate sits in a structural conflict | There is a qualified internal candidate with no conflict |
| The required command of Israeli law does not exist in-house | Daily on-site presence is required |
| The organization is starting out and wants the foundation built correctly | A mature privacy function already exists and only needs maintaining |
One clarification that matters to a parent company: outsourcing does not transfer liability. Liability remains with the database owner. What it does is ensure the role is held by someone with the time, the competence and the independence to perform it.
What the service covers
- Mapping the organization's databases and establishing the security levels the law requires
- Assessing whether the appointment obligation applies, and documenting that assessment, including conflict-of-interest mapping
- Privacy impact assessments (DPIA) following the ISO 29134 methodology
- Privacy policy and operational procedures the organization actually works to
- Handling data subject requests within the statutory deadlines
- Role-specific awareness training, rather than one deck for everyone
- Working with vendors and processors, including privacy clauses in agreements
- An annual report to management and the board on the state of privacy in the organization
- Ongoing availability for security incidents and day-to-day questions
Professional background
CISO and DPO certification from Bar-Ilan University, and practical experience serving as an outsourced Data Protection Officer inside organizations.
Frequently asked
We are GDPR compliant. Does that cover Amendment 13?
No. There is meaningful overlap, but they are separate regimes with separate obligations. Israeli requirements on appointment, database registration and data subject rights are their own, and an Israeli regulator applies them.
Can a company be appointed as DPO?
No. The opinion establishes that only a natural person can serve. An external provider is a named individual, even when the engagement is with a business.
Can our CISO also serve as DPO?
The Authority identifies a structural overlap between the two roles but does not rule it out outright. A documented, organization-specific analysis is required, explaining why no conflict arises in practice.
We hold fewer than 10,000 records. Are we exempt?
Not necessarily. The 10,000 threshold applies to data brokers only. The obligation can also arise from systematic monitoring or from processing sensitive data at significant scale, and that phrase carries no numeric threshold.
What happens if we do not appoint?
Failure to appoint is a violation for which the Authority may impose a financial sanction. An organization that has appointed a DPO may also benefit from a reduced sanction for other violations.
How long does it take to build the foundation?
In a mid-sized organization, mapping the databases and drafting the core procedures usually takes six to ten weeks. After that it becomes ongoing support at a far smaller, fixed scope.
The first step is an assessment, not a proposal
Whether the obligation applies to you, and if so what is missing today. Half an hour is enough to answer that.