The duty to appoint an officer

Amendment 13 to the Privacy Protection Law, 5741-1981, came into force on 14 August 2025. Section 17B1 of the law requires four types of bodies to appoint a privacy protection officer:

• A public body, and any holder that processes data on its behalf, even if it only stores the data.
• A body whose main purpose is collecting personal data in order to pass it on to others, where the database holds data on more than 10,000 people.
• A body whose core activity involves regular and systematic monitoring of people on a significant scale.
• A body whose core activity includes processing data of special sensitivity on a significant scale. Banks, insurance companies, hospitals and health maintenance organisations are required to appoint an officer by express provision of the law.

On 14 July 2026 the Privacy Protection Authority published an opinion on the appointment of the officer. Under the opinion, there is no numerical threshold for a “significant scale”. The considerations are listed in section 17B1(b) of the law: the number of data subjects and their share of the population, the volume and variety of the data, and the duration and frequency of the processing. For a holder that processes data for many clients, the scale is assessed cumulatively across all clients. The example given in the opinion is a holder that processes data for 1,000 databases, each holding data of special sensitivity on only 100 people.

According to the opinion, systematic monitoring is particularly relevant to tracking user activity and to building profiles of characteristics, behaviour and preferences, for example for targeted advertising, personalised content, credit scoring, insurance underwriting and fraud detection. Some of these uses rely on artificial intelligence systems.

The officer’s functions

Section 17B2 of the law lists the officer’s functions, among them:

• Acting as a professional authority and knowledge centre for management and employees.
• Training, and ongoing oversight of compliance with the law.
• Ensuring that a data security procedure and a database definitions document exist.
• Handling requests from data subjects.
• Liaising with the Authority.

According to the opinion, the officer should also be involved in decisions on acquiring and upgrading information systems, and is recommended to promote privacy impact assessments. The organisation is not bound to adopt the officer’s position, but it must give it serious consideration and give reasons for a decision not to adopt it. The officer bears no personal liability for the organisation’s non-compliance, and has no personal duty to report breaches to the Authority on the officer’s own initiative. The law provides that the officer reports directly to the chief executive or to someone directly subordinate to the chief executive.

Artificial intelligence tools and personal data

On 28 April 2025 the Authority published for public comment a draft guideline on the application of the Privacy Protection Law to artificial intelligence systems. The comment period closed on 31 July 2025, and at the time of writing no final version had been published on the Authority’s website. Under the draft:

• The law applies to a model that stores or processes personal data, both in the training stage and in the deployment stage.
• Information that the system infers about a person is personal data to which the law applies.
• Informed consent requires a description of how the system works, and disclosure to the person that they are interacting with an automated system, where this materially affects consent.
• A person’s publication of information about themselves online does not necessarily indicate consent to its use for developing artificial intelligence systems.
• A database controller that uses external generative artificial intelligence tools must adopt a dedicated organisational policy.

The draft recommends a privacy impact assessment before an artificial intelligence system is used to process personal data, and proposes appointing an officer to coordinate privacy matters in the organisation. On the guideline’s page the Authority stated that it intends to enforce the duty to appoint an officer. The opinion on the officer does not deal with artificial intelligence, and recommends that the officer promote impact assessments.

Data held by an external provider

A provider of an artificial intelligence tool that receives personal data from the organisation and stores it, or only processes it, is generally a “holder” under the law. Regulation 15 of the Privacy Protection (Data Security) Regulations, 5777-2017, governs the engagement with such an external party:

• Before the engagement: the database controller assesses the data security risks involved.
• In the agreement: the data the provider may process and the permitted purposes, the systems it may access, the type of processing, the term of the engagement, how the security duties are implemented, confidentiality undertakings signed by its authorised users, the conditions for the service being provided by another party, and reporting at least once a year and notice of a security incident.
• End of the engagement: the agreement sets out how the data is returned to the controller, how it is destroyed by the provider, and how the provider reports on this.
• Throughout the engagement: the controller takes measures to monitor and supervise the provider’s compliance with the agreement.

The Authority published a guide to implementing regulation 15 in 2023. Under its opinion on transferring personal data outside Israel under regulation 2(4) of the Transfer Regulations, a holder located outside Israel is subject to all the security duties under the Data Security Regulations, and the controller’s duties under regulation 15 also apply to an engagement with it. Many artificial intelligence tools run on servers outside Israel. The risk assessment before the engagement and the agreement with the provider are duties of the database controller, and the officer is expected to verify that they have been carried out.

Conflicts of interest

Section 17B3(c) of the law provides that the officer shall not hold another position, or be subordinate to an office holder, that may place the officer in a conflict of interest. According to the opinion, the officer cannot hold a position that includes authority to set data processing policy, such as determining the purposes of processing and making material decisions on its means. A conflict of interest exists as a rule for the head of information systems, and may often exist for the heads of marketing, customer relations and finance and for the chief technology officer. A head of information systems who chooses the organisation’s artificial intelligence tools determines the means of processing, and is therefore unsuitable to serve as its officer.

The opinion allows the officer to be placed within the organisation’s legal department, provided there is no conflict of interest. A person who also serves as legal adviser must clearly distinguish between the two roles, for example by a signature stating that they act as officer and an email box used only for that role. A footnote quotes the French data protection authority: a lawyer may serve as an external officer, but may not represent the same organisation in court in matters involving personal data.

What could change the conclusion

• A final version of the artificial intelligence guideline that places direct duties on the officer, or that shifts responsibility for reviewing the tool to the provider.
• Dedicated artificial intelligence legislation that assigns a different role holder to review artificial intelligence tools in the organisation.

Further reading

Sources

Privacy Protection Law, 5741-1981, sections 17B1 to 17B3 · Privacy Protection Authority opinion on the appointment of an officer, 14 July 2026 (Hebrew) · Draft guideline: application of the Privacy Protection Law to artificial intelligence systems, 28 April 2025 (Hebrew) · Privacy Protection (Data Security) Regulations, 5777-2017, regulation 15 · Authority opinion on transferring personal data outside Israel under regulation 2(4) (Hebrew)