Israel’s privacy law Amendment 13: a website checklist

Indicators, not legal advice. This checklist summarises public guidance from Israel’s Privacy Protection Authority for website owners. It doesn’t replace advice on your specific business.

What changed with Amendment 13

Amendment 13 is the largest update to the Protection of Privacy Law, 5741-1981, since it was passed. Among other things, it brings the definitions closer to international standards (personal data now expressly includes online identifiers and location data), narrows the duty to register databases, requires some organisations to appoint a privacy protection officer (DPO), and gives the Privacy Protection Authority the power to impose administrative fines. For most small business websites the day-to-day changes are about transparency, consent and security.

1. Map what your website collects

List every place where the site asks for or records personal data: contact and quote forms, newsletter sign-ups, checkout, account registration, chat widgets, booking tools, and third-party scripts such as analytics, advertising pixels, maps and embedded videos. To see which outside services your homepage loads scripts from:

curl -s https://yourdomain.com | grep -oE '<script[^>]+src="https?://[^/"]+' \
  | sed -E 's#.*src="https?://##' | sort -u

Repeat it for the checkout, contact and sign-up pages; tag managers can load more services after the page opens, so also check the browser’s Network tab.

2. Put a notice next to every form (section 11)

When you ask people for personal data to store and use, the request must come with a notice. Since Amendment 13 it should cover:

• Whether the person is legally required to provide the data or it is up to them, and what happens if they don’t.
• The purpose for which the data is requested (all of them, not “among other things”).
• Who will receive the data and for what purpose (the type of recipient, for example a delivery company).
• The identity of the database controller (usually your business) and how to contact it.
• The right to access the data and to ask for it to be corrected.

A short notice by the submit button, with a link to the full privacy policy, keeps the form readable. Write it in the language of your site; here is the structure:

<form action="/contact" method="post">
  <!-- name, email, phone fields -->
  <p class="form-notice">
    Providing these details is optional, but without them we can't reply to you.
    We use them only to answer your request. We share them with no one except our email provider.
    Controller: Example Ltd., privacy@yourdomain.com. You may ask to see or correct your data.
    <a href="/privacy">Privacy policy</a>
  </p>
  <button type="submit">Send</button>
</form>

3. Update the privacy policy

The privacy policy is where the full notice lives. Link it from the footer of every page, keep it in plain language, and make sure it matches what the site really does: every purpose, the types of recipients (including the analytics and advertising services you found in step 1), how long you keep data, how people can exercise their rights, and a contact address. Remove leftover template text; a policy with “[Company name]” in it tells visitors nobody read it.

4. Make consent real

Where you rely on consent, it should be an active, informed choice:

• Checkboxes start unticked. Consent to terms and consent to marketing are separate boxes.
• Marketing email and SMS need the person’s prior consent under Israel’s anti-spam rules (section 30A of the Communications Law), and every message needs an easy way to unsubscribe.
• Keep a record of when and how each person agreed, and what text they saw.
• Avoid designs that push one answer, such as a hidden “decline” option.

<label><input type="checkbox" name="terms" required> I agree to the <a href="/terms">terms</a></label>
<label><input type="checkbox" name="marketing"> Send me news and offers by email (optional)</label>

For analytics and advertising trackers, the Authority’s guidance on consent points toward separate, active consent for profiling and direct marketing. If you also serve visitors in the EU, GDPR and the ePrivacy rules already require consent before non-essential cookies, so a consent tool that loads trackers only after “Accept” covers both.

5. Handle access and correction requests

People may ask to see the personal data you hold about them and to correct or delete data that is wrong, incomplete or out of date. Publish a clear contact (for example a privacy@ mailbox), decide who answers, how you verify identity, and where the data lives. Under the regulations on access requests, access should be given within 30 days of the request.

6. Secure the data

The Privacy Protection (Data Security) Regulations, 2017, already require security measures that match the sensitivity of the data. For a website, the basics are:

• HTTPS everywhere, with a valid certificate and HSTS. See how to fix the “Not secure” warning.
• Up-to-date CMS, plugins and themes; remove what you don’t use.
• Two-factor login for every administrator, and the lowest role that works for everyone else. See how to secure the WordPress login.
• Don’t email full form submissions with sensitive details in plain text; keep them in the protected admin area.
• Backups, and a plan for what you do if there is a breach.

7. Check whether you need a DPO

The duty to appoint a privacy protection officer applies to public bodies, data brokers and direct-mailing services holding data on at least 10,000 people, organisations whose core activity is systematic monitoring of people on a significant scale, and organisations whose main activity is processing large amounts of highly sensitive data such as health, biometric or financial data. Most small business sites aren’t in these groups, but check if you run profiling, location tracking or health-related services.

Why it matters now

According to the Authority’s guide, failing to give the section 11 notice when collecting data from the public, for example through a website link, can lead to a fine of NIS 2 per person in the database (NIS 4 where it holds data of special sensitivity), with a minimum of NIS 20,000 (NIS 40,000 with sensitive data).

What HackGrade checks

HackGrade’s Pro, Business and Agency plans include compliance indicators from the same pages a visitor sees: missing privacy or terms pages, trackers loaded before consent or without a consent tool, pre-ticked consent boxes, a privacy policy without a rights section, leftover template text, and a missing accessibility statement on Israeli sites. They are indicators to review, not legal advice, and they don’t change the security grade. The free scan covers HTTPS, certificates, security headers and outdated software.