Data Protection Officer Appointment - New Obligation Under Israeli Law
An Israeli technology company processing millions of customer records contacted our firm recently with a seemingly simple question: Are we required to appoint a Data Protection Officer? The answer, as it turned out, is anything but simple, and depends on several parameters that have been clarified with the enactment of Amendment 13 to the Privacy Protection Law.
Amendment 13 to the Privacy Protection Law, 5741-1981, which entered into force in 2025, introduced a comprehensive revolution in Israel's privacy protection regulatory framework. Among the key changes are the narrowing of the database registration requirement to public bodies and data brokers only, the introduction of data breach notification obligations, and the expansion of the Privacy Protection Authority's enforcement powers. However, one of the most significant changes is the requirement to appoint a Data Protection Officer in certain entities.
The DPO appointment obligation is not entirely new - it already existed for public bodies and for those seeking recognition as a "worthy organization" from the Privacy Protection Authority. But now, for the first time, the obligation extends to private companies meeting certain criteria. This change creates a new regulatory landscape that many companies are still unfamiliar with.
Who Must Appoint a Data Protection Officer - Mandatory Criteria
Amendment 13 establishes several categories of entities required to appoint a Data Protection Officer. Understanding the precise criteria is critical, as non-compliance with this obligation could result in significant fines from the Privacy Protection Authority.
Public Bodies and Statutory Entities
Every public body in Israel must appoint a Data Protection Officer. This includes government ministries, local authorities, public institutions, health maintenance organizations, and statutory authorities. This obligation has existed for many years for these entities, but Amendment 13 has clarified the requirements and powers.
Private Organizations Based on Quantitative Criteria
The most significant innovation concerns private companies. The law stipulates that a private organization must appoint a DPO if it meets one of the following criteria as defined in regulations as of the date of this article:
- Processing personal data of a number of data subjects exceeding the threshold set in regulations
- Annual turnover exceeding the amount set in regulations
- Number of employees exceeding the number set in regulations
- Processing special categories of personal data as part of regular business activity
It is important to note that the exact amounts and numbers are updated periodically in secondary regulations, so the current status should be checked on the Privacy Protection Authority's website.
Organizations Seeking "Worthy Organization" Recognition
A company seeking recognition from the Privacy Protection Authority as a "worthy organization" - a status that confers certain advantages under the law - must appoint a DPO as part of the requirements for obtaining such recognition.
Required Qualifications and Criteria for DPO Appointment
The law and regulations establish strict requirements for the qualifications and training of a Data Protection Officer. These requirements are designed to ensure that the DPO can perform their role professionally and effectively.
Professional Education Requirements
A Data Protection Officer must meet one of the following educational requirements:
- Academic degree in law and exemption from basic legal studies (admission to the bar is not required)
- Academic degree in a relevant field such as information systems, computer science, or software engineering
- Academic degree in another field combined with proven professional experience in privacy protection or information security
In addition to educational requirements, the DPO candidate must undergo recognized professional training in privacy protection. The training must include in-depth familiarity with Israeli law, regulations, and Privacy Protection Authority guidelines.
Required Professional Experience
The regulations establish a minimum experience requirement of three years in work relevant to privacy protection. This experience may be in one of the following areas:
- Legal work in privacy protection or technology law
- Work in information security and cybersecurity
- Work in regulatory compliance in technology companies
- Work in information systems management and information technologies
Ongoing Professional Development
A DPO must undergo ongoing professional development and participate in professional conferences to stay updated on legislative and technological changes. The Privacy Protection Authority periodically publishes a list of recognized training courses.
Data Protection Officer Duties and Responsibilities Under Israeli Law
The role of Data Protection Officer is not honorary or ceremonial. The law imposes extensive professional duties and responsibilities on the DPO, with strict performance requirements.
Internal Consultation and Training
The DPO is responsible for advising organization employees on all matters relating to privacy protection obligations and law implementation. This includes:
- Preparing internal procedures for handling data subject requests
- Training employees on privacy protection and information security matters
- Supporting new technology projects regarding privacy implications
- Preparing Privacy Impact Assessments when required
Liaison with Privacy Protection Authority
The DPO serves as the official contact point between the organization and the Privacy Protection Authority. In this capacity, they must:
- Submit periodic reports as required by the Authority
- Report data breach incidents within the timeframe prescribed by law
- Handle inquiries and complaints from the Authority
- Cooperate with Authority investigations and inspections
Managing Data Subject Rights
One of the DPO's central duties is ensuring the organization respects data subjects' rights. This includes:
- Handling requests for access to personal data
- Implementing data deletion requests ("right to be forgotten")
- Enabling transfer of personal data to another party (data portability)
- Correcting incorrect or inaccurate personal data
The DPO must ensure the organization responds to these requests within the timeframes prescribed by law and in a professional manner.
Information Security Oversight
While the DPO is not necessarily a cybersecurity specialist, they must oversee implementation of security measures required to protect personal data. This includes close collaboration with the organization's IT and information security teams.
DPO Independence and Organizational Status - Legal Requirements
One of the central principles in the Privacy Protection Law is the requirement for professional independence of the Data Protection Officer. This independence is not academic - it is critical to the DPO's ability to perform their role without improper interference or pressure.
Independence in Professional Decision-Making
The law stipulates that the Data Protection Officer must have complete independence regarding professional decisions in their field. This means:
- The DPO cannot receive instructions on how to interpret or implement the law
- They cannot be subject to prior approvals on professional matters
- Company management cannot provide financial or other incentives contingent on "flexibility" in law implementation
- The DPO may contact the Privacy Protection Authority directly without company management approval
Required Organizational Status
The regulations stipulate that a DPO must have organizational status enabling them to perform their role. The required status includes:
- Direct reporting to senior management (CEO or senior VP)
- Access to all information necessary to perform the role
- Authority to order cessation of activities not complying with legal requirements
- Appropriate budget for activities involved in the role
Protection Against Dismissal
The law provides DPOs with certain protection against dismissal or demotion due to performance of their duties. DPO dismissal must be for legitimate professional reasons only, not for fulfilling their legal obligations.
External DPO Appointment
An organization may appoint an external DPO (independent consultant or consulting firm), provided the DPO meets all legal requirements and receives all necessary authorities. In this case, the organization must ensure the external DPO is reasonably available and has no conflicts of interest that could impair their independence.
DPO Appointment Process: Steps, Documents and Timelines
Appointing a Data Protection Officer is not merely an internal company decision. It is a formal process including reporting requirements to the Privacy Protection Authority and completion of official documents.
Process Steps
The appointment process includes several sequential steps:
- Obligation identification: Determining whether the organization meets criteria requiring DPO appointment
- Candidate screening: Verifying qualifications and experience of potential candidates
- Appointment decision: Formal decision by board of directors or company management
- Appointment documentation: Preparing appointment letter including all required details
- Authority notification: Submitting appointment report to Privacy Protection Authority
- Training and orientation: Training the new DPO on the organization's specific operations
Required Documents
The appointment must be made in writing and include the following details:
- Details of appointed DPO (name, ID number, address)
- Description of qualifications and professional experience
- Appointment commencement date
- Definition of areas and authorities
- DPO contact details (phone, email)
Additionally, an internal procedure should be prepared detailing how to work with the DPO and division of responsibilities within the organization.
Legal Timelines
The law establishes clear timelines for DPO appointment:
- New organizations: An organization entering a category requiring DPO appointment must appoint one within 90 days of entering the category
- DPO replacement: In case of DPO resignation or dismissal, a replacement must be appointed within 60 days
- Authority notification: The appointment must be reported to the Privacy Protection Authority within 30 days of appointment
It is important to note that until DPO appointment, responsibility for law compliance rests with organization management, and failure to appoint a DPO on time may result in fines.
Appointment Costs
DPO appointment involves various costs that should be considered in budget planning:
- Salary or fees for the DPO
- Training and professional development costs
- Technology tools for privacy management
- Professional liability insurance for the DPO
Enforcement and Penalties for Failure to Appoint a DPO
Amendment 13 to the Privacy Protection Law significantly expanded the Privacy Protection Authority's enforcement powers and increased penalties for law violations. Failure to appoint a required DPO may result in severe sanctions that could significantly impact business operations.
Financial Penalties
The Privacy Protection Authority is authorized to impose administrative fines for failure to appoint a DPO. Fines may reach significant amounts as updated periodically in regulations. The Authority considers various factors in determining fine amounts:
- Organization size and scope of activity
- Violation severity and duration of non-compliance
- Previous attempts to remedy the situation
- Damage caused or potentially caused to data subjects
- Level of cooperation with the Authority
Injunctions and Mandatory Orders
Beyond financial penalties, the Authority is empowered to issue injunctions and mandatory orders. For failure to appoint a DPO, the Authority may:
- Issue an order to appoint a DPO within a specified timeframe
- Restrict the organization's data processing activities
- Require cessation of certain types of data processing until DPO appointment
- Impose enhanced supervision on organization activities
Additional Business Consequences
Beyond formal Authority sanctions, failure to appoint a DPO may lead to additional business consequences:
- Reputational damage: Publication of fines or orders from the Authority may harm company reputation
- Customer acquisition difficulties: Many companies verify their suppliers' regulatory compliance
- International activity restrictions: Non-compliance with Israeli law may affect ability to transfer data abroad
- Financing difficulties: Investors and banks consider regulatory risks
Personal Liability of Officers
It is important to remember that alongside organizational liability, there may also be personal liability for senior officers. Directors and senior managers who neglect the appointment obligation may face personal liability, especially if such neglect caused damage to data subjects.
Given the significant risks, companies meeting DPO appointment criteria are advised to act quickly and not delay the appointment. It is preferable to begin the process early and ensure full legal compliance.
The information contained in this article is general in nature and does not constitute legal advice. For advice tailored to the specific circumstances of your company, we invite you to contact our firm.
