Israel's Privacy Law Amendment 13: What a Site Owner Actually Has to Do

Is there a contact form on your site? A name and phone field? Then Amendment 13 to Israel's Privacy Protection Law is talking to you too — not just to banks and HMOs. It has been in force since 14 August 2025, and most small sites simply haven't caught up yet.

The usual clarification first: I'm a developer, not a lawyer. What's written here is the site's side — what the code and the pages need to do. The full legal side gets closed with a lawyer, preferably one who works in privacy.

What Changed, in Two Minutes

The Privacy Protection Law dates from 1981. Amendment 13 is its big update for an era where every business collects digital information, and it does several things at once:

• Expands the duty of notification. When personal information is collected, the person must be told clearly: what is collected, for what purpose, whether it is passed to anyone else, and what their rights are — access, correction and deletion.
• Significantly strengthens enforcement. The Privacy Protection Authority has broader powers than before, and there is exposure to lawsuits as well. I deliberately avoid quoting amounts — they depend on circumstances, and that is what legal counsel is for.
• Requires appointing a privacy protection officer in certain kinds of organisations.
• Reduces the database registration obligation — less bureaucracy on that side, more responsibility on the transparency side, toward the people themselves.

For an average site owner, the line that matters is the first one: the duty of notification meets you at every form.

What Counts as "Personal Information" on a Normal Site

More than you'd think. A name and phone in a form — yes. A newsletter email address — yes. But also what you can't see: a Facebook pixel identifying visitors, an analytics system recognising a return visit, a mailing platform tracking opens. If something on the site sends data about the visitor to any server — it's in scope.

Which is why the first step is not writing a policy. The first step is mapping: which forms exist, which scripts run, and what each one collects. You can't notify about what you haven't mapped.

The Duty of Notification on Forms: What Right Looks Like

The requirement is not a long legal page beside every field. It's a few clear lines, attached to the form itself:

• What is collected (name, phone, email).
• Why (to get back to you about your enquiry).
• Whether the information is passed on (to a mailing system, for example).
• A link to the full privacy policy, and how to request access or deletion.

Two principles turn this from fine print into something real: the notice sits beside the form, not buried in the footer; and it's written in human language, not contract language.

And if there's marketing email — its consent is separate, not pre-ticked, and not a condition for getting the service.

A privacy policy is a declaration. What matters is whether the site actually does what it says — and doesn't do what it doesn't say.

The Common Mistake: a Generated Policy

Because the law came into force, tools popped up that produce a "customised privacy policy" in one click. The problem is identical to floating accessibility widgets, and regular readers already know the line: the generator adds a page, it doesn't change what the site does.

If the policy declares "we do not share information with third parties" while a Meta pixel fires on every page — you've created a document that contradicts reality, which is worse than writing nothing. The right order is the reverse: first fix what the site does, then write down what it does.

A Practical Site Checklist

1. Map. Every form, every external script, everything that collects something. Half an hour's work on most small sites.
2. A notice beside every form. Short, clear, in human language.
3. Separate marketing consent, never pre-ticked.
4. Cookie and measurement disclosure. A notice about the use, detail in the policy.
5. A privacy policy describing this site, not a generic one — including a contact route for access and deletion requests.
6. HTTPS and minimisation. Don't collect fields you don't need. Every field removed from a form is both one less obligation and more conversions.
7. A consistency check: the policy, the forms and the actual behaviour all say the same thing.

If you want to see it live — this very site went through the process: a cookie notice, form notification, and a policy written from what actually runs here.

What About Sites That Also Serve Abroad?

Amendment 13 is Israeli law and applies to your Israeli site regardless. If you also sell to customers in the EU, GDPR is a separate and in places stricter obligation. The good news: a site in order under Amendment 13 has covered serious ground in that direction too.

The Bottom Line

Amendment 13 is not a reason to panic, but it is the end of the era when a form on a site was purely a design decision. For an average site, compliance is orderly work of days, not months — and it costs far less than the alternative.

Want to know where your site stands? That's exactly the service — or just send me the URL and I'll tell you what's missing, jargon-free.