Skip to main content

Amendment 13 to the Privacy Protection Law: What a Small Business Must Do Right Now - Rtek

Amendment 13 to Israel's Privacy Protection Law took effect in August 2025, and it has no exemption for small businesses. If you have a customer list, a mailing list or security cameras, it applies to you too. A practical guide.

Rtek September 4, 2026 4 min read
privacy protection cybersecurity small business guide

Amendment 13 to the Privacy Protection Law: What a Small Business Must Do Right Now

Do you have an Excel file with customer details? A newsletter mailing list? A security camera at the office entrance? Since August 14, 2025, each of these is defined as a “database” under the updated Privacy Protection Law 5741-1981, and the law has no exemption for small businesses. Even a business with 3 employees has to comply with the rules.

This amendment didn’t pass quietly. It changes how responsibility is divided, expands the enforcement powers of the Privacy Protection Authority, and requires businesses to know exactly which databases they have and how they’re protected. Here’s what you actually need to do, without the scare tactics and without the legalese.

What Changed in Amendment 13

According to the Privacy Protection Authority’s official guide (Hebrew), the amendment sharpens three things in particular:

  • Transparency: You must tell people how their data will be used, in clear language, not just in a clause hidden at the bottom of the website.
  • Consent: Collecting data for purposes that aren’t necessary for the service requires explicit consent, not implied consent.
  • Accountability and enforcement: The database owner (meaning you, the business owner) bears direct responsibility, and the Authority has been given broader enforcement tools, including administrative fines.

What Actually Counts as a “Database”

The definition in the law is broad on purpose. All of these are databases:

  • A customer or supplier database: any file with names, phone numbers, ID numbers or addresses
  • An employee database: pay slips, contracts, personal details
  • A mailing list, including an email newsletter
  • A database of security footage (office cameras)
  • Any CRM database, digital signature system, or customer management platform

If anything on this list sounds familiar, you have a database, and Amendment 13 applies to you.

Is a Small Business Exempt from Anything?

The obligation to formally register a database with the Privacy Protection Authority applies only to public bodies and data brokers with a database of more than 10,000 people. Most small businesses don’t reach that threshold and don’t need to register their database.

But that isn’t an exemption from the law itself. The transparency, consent, and security obligations apply to every database, of any size.

What to Actually Do: A Checklist

1. Map Your Databases

Go through every place where you store personal data: files, systems, emails, old Excel sheets on the desktop. You can’t protect a database you didn’t know existed.

2. An Updated, Accessible Privacy Policy

Not a legal document nobody reads, but a short, clear text that explains what data is collected and why.

3. Real Technical Data Security

This is where the law directly touches your IT infrastructure. See our full guide to cybersecurity and Amendment 13 compliance:

  • Access control: only people who need access to the database can reach it. We covered this in detail in our guide Access Control: A Guide for Managers.
  • Encryption: sensitive data in transit and at rest. We covered the topic in detail in our data encryption guide.
  • Secure backups: so that data loss doesn’t turn into a privacy breach. See Why Backups Matter for Your Business.
  • Access logs: a record of who touched the database and when.

A contact form or mailing-list sign-up must ask for explicit consent, not “by continuing to use the site you agree to…“.

5. The Ability to Delete and Correct Data

If a customer asks you to delete their data, you need to be able to actually do it, not just state that you can.

When You Need Professional Help

If you read the list above and you’re not sure which databases you have, where they’re stored, or who in the business can access them, this is exactly the moment to stop and map them, before a regulator does it for you. Database mapping, access control and encryption are IT infrastructure every business needs regardless of the law. Amendment 13 just turned them from “nice to have” into a “documented obligation.”

Summary

Amendment 13 doesn’t ask you to become a law firm. It asks you to know what data you have, to actually protect it, and to be transparent about how you use it. If your technical infrastructure (backups, encryption, access control) is already in order, you’re most of the way there.

Want to map your databases and check that your technical infrastructure meets the requirements? At Rtek we guide businesses to full compliance as part of our cybersecurity services package. Contact us for a short consultation call.