Israel's Privacy Protection Authority has opened 178 new cases since Amendment 13 to the Privacy Protection Law took effect in August 2025. The Authority's figures were published on 10 November 2026. The cases cover supervision, administrative inquiries and in-depth audits of specific organizations. Alongside them run about 244 sector-wide supervision files, which look at a whole industry rather than one company.
Most of those cases are still undecided. 158 are open and only 20 have closed. Some of the closed ones ended in a financial sanction, others with no penalty. Any of the open ones can still end in a fine.
Where the cases come from
According to the Authority, the most common subject is a serious data security incident or a suspected leak. Next come the duty to inform and privacy policies, both governed by section 11 of the law, followed by biometric data and surveillance cameras. The sectors under review are broad: banks, insurers and investment houses, health funds, local authorities, telecom and cloud providers, and retail.
The sanctions imposed so far show the range. One municipality paid ₪64,000 over gaps in its database definitions document and security procedures that ignored outside contractors holding its data. A health fund and an insurer were fined for failing to report a serious security incident to the Authority straight away.
A sign-up form that cost ₪12,000
The case closest to a small business involved a go-kart venue. A customer trying to book an activity filled in an online form that asked for her ID number, full name, date of birth, phone, city and details about her children. She complained to the Authority.
The Authority found that the form carried none of the notice the law requires, and that the website had no full privacy policy at all. The sanction was set at ₪20,000 and cut to ₪12,000 because the company had no previous breaches and had fixed the problems. The company argued the matter was trivial and that it acted in good faith. The Authority rejected that, noting the fixes came only after the inquiry opened. Its head of enforcement called the duty to inform a cornerstone of privacy law and a breach of it a material one.
The five details a form needs
Section 11 sets out what a person must be told when asked to hand over details for a database. The notice says whether they are legally required to provide them, why the data is collected, who it will be passed to, who controls the database, and how to ask to see and correct it. Those are exactly the items the Authority found missing in the go-kart case.
A booking form for an activity is about as ordinary as forms get. Contact forms, newsletter sign-ups, appointment bookings and quote requests work the same way. Each of them collects personal details, so each needs the notice and a link to a full privacy policy.
Checking your own forms
Go through every form on your website, including the ones left on old landing pages. Make sure each has a short notice covering the five details and a link to a privacy policy that answers them in full. Ask whether every field is needed. The complaint in this case began with a form that asked about children.
If forms are how most customers reach you, it is a good moment to look at why a business website brings no leads as well. If your site runs Facebook or TikTok pixels, check consent too, since Israel already has a wave of class actions over pixels and cookies. On the security side, the National Cyber Directorate opened a free portal that tests a business's email security earlier this month, useful when an unreported incident is the most common reason the Authority opens a case.