Protection of Privacy Law (1981)

Israel

v2022 amendment (effective 2023)

30 domains

33 controls

Protection of Privacy Law, 1981 (Law 5741‑1981) together with the Data Security Regulations 2017 (5777‑2017) and the 2022 amendment (effective 2023) introducing data‑breach notification and establishing a Data Protection Authority.

Verified

Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (30)

Access Control

2 controls

Controls in the Access Control domain of Protection of Privacy Law (1981) — 2 controls
Code	Title	Description
PPL-DSR-ACCESS	Access Control and Authorisation Management	Regulations 8 and 9 require access to be limited to authorised personnel with a job need, with role-based authorisation...
PPL-DSR-AUTH	Authentication and Password Controls	Regulation 9 requires identification and authentication of users prior to access. Passwords must meet complexity, length...

Audit

1 controls

Controls in the Audit domain of Protection of Privacy Law (1981) — 1 controls
Code	Title	Description
PPL-DSR-AUDIT	Mandatory Internal Security Audit	Regulation 16 requires high-tier database owners to undergo an internal security audit at least every 24 months performe...

Breach Notification

1 controls

Controls in the Breach Notification domain of Protection of Privacy Law (1981) — 1 controls
Code	Title	Description
PPL-DSR-BREACH	Severe Security Event Notification to PPA	Regulation 11 requires the database owner to document every security event and to notify the Privacy Protection Authorit...

Cloud and Vendor

1 controls

Controls in the Cloud and Vendor domain of Protection of Privacy Law (1981) — 1 controls
Code	Title	Description
PPL-DSR-VENDOR	Vendor Encryption and Cloud Hosting	Where databases are hosted in cloud or with third-party infrastructure providers, the database owner remains accountable...

Confidentiality

1 controls

Controls in the Confidentiality domain of Protection of Privacy Law (1981) — 1 controls
Code	Title	Description
PPL-S16-CONF	Confidentiality and Use Limitation	Section 16 imposes a duty of confidentiality on any person who in the course of their duties comes into possession of in...

Data Subject Rights

2 controls

Controls in the Data Subject Rights domain of Protection of Privacy Law (1981) — 2 controls
Code	Title	Description
PPL-S13-ACCESS	Subject Right of Access	Section 13 grants every person the right to inspect information concerning them held in a database. The database owner m...
PPL-S14-CORRECT	Right to Correction and Deletion	Section 14 provides the right to request correction or deletion of information that is incorrect, incomplete, unclear, o...

Database Registration

1 controls

Controls in the Database Registration domain of Protection of Privacy Law (1981) — 1 controls
Code	Title	Description
PPL-S8-REG	Database Registration with the Registrar	Section 8 requires registration of databases with the Database Registrar at the Privacy Protection Authority where the d...

Decommissioning

1 controls

Controls in the Decommissioning domain of Protection of Privacy Law (1981) — 1 controls
Code	Title	Description
PPL-DSR-RESID	Residual Information and Decommissioning	When systems are decommissioned or media replaced, residual personal data must be securely erased. Regulation 7 requires...

Direct Marketing

1 controls

Controls in the Direct Marketing domain of Protection of Privacy Law (1981) — 1 controls
Code	Title	Description
PPL-S17F-DM	Direct Mailing and Opt-Out	Section 17F regulates direct mailing services where personal data is used to address individuals. Each communication mus...

Documentation

1 controls

Controls in the Documentation domain of Protection of Privacy Law (1981) — 1 controls
Code	Title	Description
PPL-DSR-DEF-DOC	Database Definition Document	Regulation 2 requires every database owner to maintain a database definition document covering purposes of the database,...

Endpoint Security

1 controls

Controls in the Endpoint Security domain of Protection of Privacy Law (1981) — 1 controls
Code	Title	Description
PPL-DSR-MOBILE	Portable Devices and Removable Media	Regulation 13 addresses portable computing devices and removable media used to process or store personal data. Such devi...

Enforcement

1 controls

Controls in the Enforcement domain of Protection of Privacy Law (1981) — 1 controls
Code	Title	Description
PPL-S5-PENAL	Civil and Criminal Penalties	The PPL provides civil liability under s.4 for infringements of privacy with statutory damages up to NIS 50,000 per subj...

Incident Management

1 controls

Controls in the Incident Management domain of Protection of Privacy Law (1981) — 1 controls
Code	Title	Description
PPL-DSR-EVENT	Security Event Register and Documentation	Regulation 11 also requires the database owner to maintain an internal register of every security event, severe or not....

International Transfers

1 controls

Controls in the International Transfers domain of Protection of Privacy Law (1981) — 1 controls
Code	Title	Description
PPL-REG2-XBORDER	Cross-Border Transfer Restrictions	The Privacy Protection (Transfer of Data to Databases Abroad) Regulations 5761-2001, Regulation 2, prohibit transfer of...

Lawful Basis

1 controls

Controls in the Lawful Basis domain of Protection of Privacy Law (1981) — 1 controls
Code	Title	Description
PPL-S11-CONSENT	Lawful Collection and Informed Consent	Section 11 requires that when requesting information from a data subject, the requester must notify the subject whether...

Logging

1 controls

Controls in the Logging domain of Protection of Privacy Law (1981) — 1 controls
Code	Title	Description
PPL-DSR-LOG	Logging and Monitoring	Regulation 10 requires logging of access events and security events for medium and high tier databases. Logs must captur...

Network Security

1 controls

Controls in the Network Security domain of Protection of Privacy Law (1981) — 1 controls
Code	Title	Description
PPL-DSR-COMM	Communications Security and Network Segregation	Regulation 14 requires that medium and high tier database systems be segregated from public networks and protected by ap...

Physical Security

1 controls

Controls in the Physical Security domain of Protection of Privacy Law (1981) — 1 controls
Code	Title	Description
PPL-DSR-PHYS	Physical and Environmental Security	Regulation 7 requires physical security for database systems and media commensurate with tier. Servers must be in access...

Public Sector

1 controls

Controls in the Public Sector domain of Protection of Privacy Law (1981) — 1 controls
Code	Title	Description
PPL-S23-CONS	Public Body Data Sharing and Consent	Sections 23 to 23C regulate sharing of information between public bodies and from public bodies to private entities. Sha...

Reform Readiness

1 controls

Controls in the Reform Readiness domain of Protection of Privacy Law (1981) — 1 controls
Code	Title	Description
PPL-A13-AMEND	Amendment 13 Readiness	Amendment 13 to the PPL (in force from August 2025 with phased application) modernises the law, narrows the definition o...

Regulator Engagement

1 controls

Controls in the Regulator Engagement domain of Protection of Privacy Law (1981) — 1 controls
Code	Title	Description
PPL-PPA-INSPECT	PPA Inspections and Information Requests	The Privacy Protection Authority is empowered to inspect databases, request information, and issue orders under the PPL...

Resilience

1 controls

Controls in the Resilience domain of Protection of Privacy Law (1981) — 1 controls
Code	Title	Description
PPL-DSR-BACKUP	Backup and Restore	Regulation 17 requires arrangements for backup of databases, including frequency and retention appropriate to tier, secu...

Retention

1 controls

Controls in the Retention domain of Protection of Privacy Law (1981) — 1 controls
Code	Title	Description
PPL-DSR-RETAIN	Data Retention and Disposal	Although the PPL does not impose a single retention period, the use-limitation principle (s.2 and s.8(b)) requires that...

Risk Management

1 controls

Controls in the Risk Management domain of Protection of Privacy Law (1981) — 1 controls
Code	Title	Description
PPL-DSR-RISK	Risk Assessment and Penetration Testing	Regulations 5 and 6 require medium and high-tier database owners to conduct a risk assessment at least every 18 months i...

Scope and Definitions

1 controls

Controls in the Scope and Definitions domain of Protection of Privacy Law (1981) — 1 controls
Code	Title	Description
PPL-S2-DEF	Personal Information and Sensitive Information Definitions	Section 2 of the Privacy Protection Law defines 'information' broadly as data on personality, personal status, intimate...

Secure Development

1 controls

Controls in the Secure Development domain of Protection of Privacy Law (1981) — 1 controls
Code	Title	Description
PPL-DSR-DEV	Secure Development and Change Control	Regulation 4 requires that changes to systems holding personal data are managed through documented change control. Devel...

Security Governance

2 controls

Controls in the Security Governance domain of Protection of Privacy Law (1981) — 2 controls
Code	Title	Description
PPL-DSR-OFFICER	Security Officer Appointment and Independence	Regulation 3 requires appointment of an information security officer where the database owner has five or more databases...
PPL-S17-SEC	Security Obligation and Database Manager Role	Section 17 requires the database owner, holder, and manager to ensure that the database has appropriate security. Each d...

Security Tier Classification

1 controls

Controls in the Security Tier Classification domain of Protection of Privacy Law (1981) — 1 controls
Code	Title	Description
PPL-DSR-CLASSIFY	Database Security Tier Classification	The Privacy Protection (Data Security) Regulations 5777-2017 classify databases into three security tiers (basic, medium...

Third Party Risk

1 controls

Controls in the Third Party Risk domain of Protection of Privacy Law (1981) — 1 controls
Code	Title	Description
PPL-DSR-PROC	Processor (Outsourcing) Controls	Regulation 15 governs use of an outsourced data holder. The owner must select a processor with adequate security, sign a...

Training

1 controls

Controls in the Training domain of Protection of Privacy Law (1981) — 1 controls
Code	Title	Description
PPL-DSR-AWARE	Security Awareness and Training	Regulation 12 requires the database owner to ensure that authorised users receive instruction on the security obligation...

Frequently Asked Questions

What is Protection of Privacy Law (1981)?

Protection of Privacy Law (1981) is a compliance framework from Israel with 30 domains and 33 controls. Protection of Privacy Law, 1981 (Law 5741‑1981) together with the Data Security Regulations 2017 (5777‑2017) and the 2022 amendment (effective 2023) introducing data‑breach notification and establishing a Data Protection Authority. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

How many controls does Protection of Privacy Law (1981) have?

Protection of Privacy Law (1981) has 33 controls organised across 30 domains. The largest domains are Access Control (2 controls), Data Subject Rights (2 controls), Security Governance (2 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

What frameworks does Protection of Privacy Law (1981) map to?

Protection of Privacy Law (1981) does not currently have cross-framework mappings in our system. Check back as we continuously expand our mapping database.

How do I get started with Protection of Privacy Law (1981) compliance?

Start your Protection of Privacy Law (1981) compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about Protection of Privacy Law (1981) requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 33 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 768 frameworks.

Get Started Free →

Free forever — no credit card required