Database registration in Israel — when a business must, and what happens if not?

What is the Israeli database registry, and who runs it?

The Protection of Privacy Law, 5741-1981 establishes a registry of databases, kept by the head of the Privacy Protection Authority (section 12 of the law). For decades, registration was the entry gate for almost every business database: a broad duty, widely known and widely ignored. Amendment 13, in force since 14 August 2025, turned it into a focused duty that applies to few.

Before asking whether you must register, it is worth asking whether you have a “database” at all. Section 3 of the law defines a database as a collection of personal data processed by digital means, and carves out two cases: a collection for personal, non-business use; and a collection holding only names, addresses and contact details on 100,000 people or fewer — provided its owner, or a corporation under the owner's control, holds no other collection with further details on the same people.

Most businesses cross that threshold without noticing: the moment order history, invoices or notes on customers sit alongside the contact list, the carve-out no longer applies, and there is a database. We covered the definition in our article on Amendment 13 to the Protection of Privacy Law.

Who must register a database after Amendment 13?

Section 8A(a) of the law, as amended, sets only two cases in which a database must be registered. The first: a database whose main purpose is collecting personal data in order to pass it to others as a business or for payment, including direct-mail services, holding personal data on more than 10,000 people — in other words, data traders. The second: a database whose controller is a public body — government ministries and state institutions, local authorities and bodies performing public functions under law — unless the database holds data on the body's own employees only.

The test is what the database is for, not how big it is. A shop running a customer club, a clinic managing patient files or a firm managing client matters collect data for their own purposes, not to sell it on. They are not data traders, and so they do not have to register — however large the database grows.

Two refinements complete the picture. The head of the Authority may exempt even a registrable database from registration, if satisfied that registration is not needed (section 8A(a)(3)); and the registration duty does not apply at all to a database holding only data lawfully published to the public (section 8A(c)).

Does mailing your customers require registering a database?

Here sits a common confusion worth untangling. The law distinguishes between direct mail — approaching a person based on data in a database, which every business does with its own customers — and direct-mail services: passing lists and data to others, as a service. Mailing your own customers does not in itself trigger a registration duty.

By contrast, whoever provides direct-mail services to others may not process data in such a database unless it is registered, with direct-mail services among its registered purposes (section 17D). And anyone trading in lists holding data on more than 10,000 people falls under the general registration duty of section 8A anyway. Even those exempt from registration remain bound by the direct-mail rules themselves — above all, everyone's right to demand that their data be deleted from a database used for direct mail (section 17F).

How is a database registered, and what happens after filing?

Whoever does have to register files an application with the head of the Privacy Protection Authority (section 9 of the law). The application states:

• the identity of the database's controller, an address in Israel and contact details, and the identity of the privacy protection officer;
• the type of service a holder provides to the controller, where the database is held by an external party;
• the purposes for which the database was set up and for which the data is intended;
• the types of data the database will hold;
• details of data transfers out of the country and of regular receipt of data from a public body.

The head of the Authority registers the database within 60 days of filing, unless there are reasonable grounds to believe the database serves unlawful activity or that its data was collected unlawfully (section 10(a)(1)). If the period passes with no notice of refusal or suspension, the database is treated as registered, and work may proceed (section 8A(a)(2)). If the head of the Authority notifies a refusal or suspension, processing data in the database is prohibited unless a court rules otherwise (section 10(b2)).

What happens if a registrable database is not registered?

The prohibition itself is sharp: the controller of a registrable database may not process personal data in it, nor allow another to process data for it, as long as the database is unregistered (section 8A(a)(2)). “Processing” under this law is almost everything — receiving, collecting, storing, viewing, disclosing. A business that must register and has not is in continuous breach, not a one-off technical slip.

On top of the prohibition sits the enforcement machinery Amendment 13 handed the Authority: the head of the Authority may impose a financial sanction for processing data in a registrable, unregistered database, for filing incorrect details in a registration application and for failing to report changes to the registered details. Failing to file the notice a large sensitive database owes the Authority is listed there too. The amounts are fixed by the law, and for very large databases they double.

There is direct civil exposure as well: a person whose data sits in a registrable, unregistered database, who demanded that the controller register it and was not answered within 90 days, may sue for exemplary damages that do not depend on proof of harm (section 15A(a)(1)). And for those who did register, the discipline continues: every change to the registered details must be reported (section 9(d)), and the head of the Authority may suspend or cancel the registration of a database that violates the law (section 10(f)).

Why is exemption from registration not exemption from the law?

And here is the trap this article was written for. Many businesses heard that “the registration duty was abolished” and concluded that privacy law no longer concerns them. But registration was always just procedure — the substantive duties never depended on it. Amendment 13 sharpened exactly that: less paperwork, more enforcement of what actually happens to the data.

The central duty is data security: the database's controller and its holder are each responsible for securing the data in it (section 17(a)), and the Protection of Privacy Regulations (Data Security), 5777-2017 spell out what that means in practice — a database definitions document, access permission management, and security tiers set by the type and scale of the data. None of it depends on registration. Alongside it: the duty to notify the Authority once a database holds specially sensitive data on more than 100,000 people (section 8A(b)), and the duty to appoint a privacy protection officer for whoever falls within the categories of section 17B1.

Facing all of these stand people's rights: to know, when their data is collected, who is collecting it, for what purpose and what their rights are (section 11); to access the data held on them (section 13); and to demand its correction or deletion (section 14). An unlawful refusal to allow access, or an agreed correction never carried out, exposes the business to exemplary damages under section 15A — regardless of the registration question.

Notice what the whole list has in common: none of these duties is fulfilled by a form. Who sees which data, whether everything held on a person can be located and deleted, whether access is logged — all of that is decided by how the system is built. A system managing sensitive data — a law firm's client file is the clearest example — needs permissions, encryption and logging by default, and a system built around how you actually work answers a deletion demand with a click, instead of a manual hunt through scattered files.

If you are not sure where your business stands — whether you have a database at all, whether you are near one of the thresholds, and how your current system measures up — send us a short message about what you manage and where.