When Personal Data Moves to a Third-Party Vendor, Who Is Liable?
An Israeli SaaS company signs an agreement with a cloud hosting provider and transfers its entire customer database to it: contact details, purchase history, and sometimes financial information as well. If the vendor suffers a security incident, who is responsible? In most cases, the answer is unambiguous: the company that holds the database, not the vendor.
The Privacy Protection Regulations (Data Security), 5777-2017, establish a clear mechanism for this exact scenario, in Regulation 15, which governs the transfer of data processing to an external party. Every technology company that uses cloud vendors, CRM systems, support centers, or any other party that processes personal data on its behalf must comply with this regulation, and failing to do so exposes the company to direct legal liability.
The Legal Framework: Regulation 15 of the Data Security Regulations
The Privacy Protection Regulations (Data Security), 5777-2017, were enacted under the Privacy Protection Law, 5741-1981, as amended by Amendment 13, and set the required security level for databases in Israel based on the sensitivity and scope of the data involved. The regulations apply both to the "database owner" (the party for whose purpose and benefit the data is collected) and to the "database holder" (any party that physically holds the data, even if it is not the owner).
Regulation 15 addresses a scenario extremely common in the technology sector: a database owner transfers data processing to an external vendor, whether a cloud provider, a marketing firm, a support center, or any other subcontractor. The regulation provides that such a transfer is permitted only where a written agreement is in place between the parties, containing specific undertakings regarding data security.
It is worth emphasizing: a general services agreement is not sufficient under the regulation. It requires dedicated provisions that explicitly address the protection of the personal data being transferred, at a level commensurate with the sensitivity of the data and the scope of its use.
What a Compliant Data Processing Agreement Must Include
A data processing agreement that satisfies Regulation 15 should include, among other things, the following components:
- Purpose limitation — the vendor may process the data solely for the purpose of providing the agreed service, and for no other purpose.
- Appropriate security level — a vendor commitment to implement physical, technological, and organizational security measures proportional to the sensitivity of the data processed.
- A prohibition on subcontracting without the database owner's prior written approval, and subject to imposing the same security obligations on the subcontractor.
- Return or deletion of the data at the end of the engagement, or at any other time upon the database owner's request.
- An audit and oversight right — allowing the database owner to verify compliance with the security undertakings, including through periodic audits.
- A security incident reporting duty — a vendor commitment to immediately notify the database owner of any suspected security incident or data breach.
An agreement that lacks these provisions does not satisfy the regulation's requirements, even if it is labeled a comprehensive, detailed "services agreement."
The Liability That Does Not Transfer to the Vendor
One of the most common mistakes is assuming that once data has been transferred to a vendor, liability transfers along with it. Israeli law does not work this way. The database owner remains accountable to data subjects and to the Privacy Protection Authority, even when the actual processing is carried out by a third party.
The practical implication: even if the vendor caused the security incident, the company that handed over the data may bear regulatory and civil liability, unless it can demonstrate that it took all reasonable measures, including signing a compliant data processing agreement and effectively monitoring its implementation.
For this reason, the processing agreement is not merely a formal document for satisfying the regulation, but a genuine tool for protecting the company in the event of litigation or an enforcement proceeding.
How Amendment 13 Affects Vendor Data Processing Agreements
Amendment 13 to the Privacy Protection Law, 5741-1981, which took effect on August 14, 2025, sharpened the importance of data processing agreements with vendors. The amendment added a duty to report serious security incidents to the Privacy Protection Authority, and in some cases to data subjects as well, and significantly expanded the Authority's enforcement powers, including the imposition of administrative fines.
When a security incident occurs at an external vendor, the database owner's reporting duty depends on the vendor having notified it in time, which makes the immediate-reporting clause in the processing agreement even more critical following the amendment. A company unaware of a security incident at its vendor may find itself in breach of its own reporting duty, through no fault of its own and with no real opportunity to comply.
It is also worth noting that Amendment 13 narrowed the database registration requirement so that it now applies mainly to public bodies and to entities engaged in data trading above the threshold set by law, but this narrowing does not diminish the security and proper-processing obligations that apply to all database owners, including the duty to enter into compliant data processing agreements with vendors. As of the date of this article, it is advisable to monitor updated guidance published by the Privacy Protection Authority on this topic.
Common Mistakes in Drafting Vendor Agreements
In reviewing vendor agreements, several mistakes recur time and again:
- Relying on a vendor's ISO 27001 or SOC 2 certification as a substitute for a dedicated data processing agreement — such certifications reflect internal procedures but do not create a contractual obligation toward the database owner.
- Using the vendor's generic Terms of Service without examining whether they satisfy Israeli legal requirements.
- Failing to address the vendor's own subcontractors — a common scenario in multi-layered cloud services, where data passes through several parties without the database owner being aware of it.
- Not verifying the physical storage location of the data, which may raise additional questions regarding transfers of data outside Israel.
- Lacking a practical mechanism to verify that data has actually been deleted at the end of the engagement with the vendor.
Practical Steps to Take Before Signing
Before signing an agreement with a vendor that will process personal data on the company's behalf, it is advisable to take the following steps:
- Map all vendors that have access to the company's personal data, including subcontractors.
- Assess the sensitivity of the data being transferred and calibrate security requirements accordingly.
- Confirm that the agreement includes all elements required under Regulation 15, rather than a general reference to "confidentiality."
- Establish a clear, fast mechanism for the vendor to report security incidents.
- Secure an audit right and appropriate indemnification clauses in the event of a breach.
- Periodically verify, not just at signing, that the vendor is actually meeting its commitments.
A compliant data processing agreement is not a one-time document signed and filed away. It is a living risk-management tool that needs to be updated as vendors, the scope of processed data, and regulatory requirements change. Companies that invest in drafting these agreements precisely significantly reduce their legal exposure and build a more solid foundation for long-term vendor relationships.
The information contained in this article is general in nature and does not constitute legal advice. For advice tailored to the specific circumstances of your company, we invite you to contact our firm.
