Amendment 13 to Israel's Privacy Protection Law: What It Means If You Keep Customers in a Spreadsheet

Amendment 13 to Israel's Privacy Protection Law was approved by the Knesset on 5 August 2024 and came into force on 14 August 2025, according to a published opinion of the Privacy Protection Authority. It updated core definitions, widened the Authority's enforcement powers, and added a duty to appoint a privacy protection officer in defined categories.

This is a factual description of what the amendment addresses, not legal advice. Which duties apply to a particular business is a question for a lawyer or for the Privacy Protection Authority.

What changed at the level of definitions, and why a developer cares

Definitions are the part that matters to anyone building systems, because they decide which actions count at all. The Authority's opinion notes that under the updated definition of "processing" in the law, processing personal data is any operation performed on personal data, including the mere storage of the data or viewing it.

In engineering terms that is a significant statement, because it does not distinguish a system that processes data from one that merely holds it. An old file server nobody touches holds data, and a spreadsheet somebody opens once a month is viewed. Both cases sit under the same word.

Every term in the table is defined in the text of the law. The table explains why it comes up in a conversation about a spreadsheet, not what follows from it.

Who is who around a single customer file?

That is the first question a real system runs into, because a customer file almost never sits in one place. The Authority's opinion explains that under the updated definition, where an external party stores data or views it on behalf of another body, that party is a "holder" under the law.

For a technical map, that translates into questions answerable without a lawyer:

• Which party decided what is collected and for what purpose.
• Which external vendors actually touch the file, including backup storage and support.
• Which employees can open it today.
• What other places hold copies of the same file.
• Who would be alerted if the file left the organisation.

Those answers are data, not conclusions. They are also exactly what turns a meeting with a lawyer into a precise question rather than a general one.

What the Authority published about the officer-appointment duty

The Privacy Protection Authority published a dedicated opinion on appointing a privacy protection officer under the requirements of Amendment 13. The document states that the duty applies to public bodies and to a range of further organisations whose activity involves high privacy risk, and it sets out the categories by reference to sections of the law.

Among the categories it discusses is, for example, a controller of a database whose main purpose is collecting personal data in order to pass it to others as a business or for consideration, where the database holds data on more than 10,000 people. The document details further categories, notes that its detail is not exhaustive, and states that in case of doubt a specific question can be put to the Privacy Protection Authority.

What you can do without deciding any legal question

The gap between "we do not know whether this applies to us" and "we do not know what we hold at all" is an engineering gap, and it can be closed without deciding anything legal.

• Record where the file sits, in how many copies, and in which services.
• Know who accesses it, when, and under what permission.
• Know where the data came from and for what purpose it was collected.
• Know what leaves: file exports, email attachments, uploads to an external tool.
• Know what is deleted and when, not only what is kept.

The fourth item is the one that surprises people. A customer file sent to somebody so they can analyse it in an external tool has left the organisation's boundary, which is an entirely separate consideration described in assessing the risk of putting customer data into an AI tool. The inventory itself, and how to build one, is covered in mapping personal data in a small business.

What the Authority published about enforcement powers

A second aspect of the amendment, beyond definitions, is what the Authority can do. The opinion on appointing an officer states that the interpretation set out in it will be used by the Authority when exercising the powers granted to it, including the power to impose financial sanctions for breach of the duty to appoint a privacy protection officer and of other provisions of the law concerning that officer's standing and terms of engagement.

Two points follow for anyone running systems, and both are factual:

• The Authority's documents are not only explanation. They declare the interpretation it will actually use, so the source is worth reading rather than a summary of it.
• The law's terms are defined there rather than in everyday business language, so "customer", "record" or "list" do not map one-to-one onto the statutory terms.

What follows from that for a specific business is not a matter for technical description. That is precisely the point where the question moves to a lawyer or to the Authority itself.

Why is a spreadsheet the hardest artifact to describe?

Not because of its contents, but because of its behaviour. A database can be described: there is a schema, there are permissions, there is a log. A spreadsheet splits.

• It is sent as an attachment, and every recipient holds a copy.
• It is saved on the desktop, in the cloud, and in an old backup folder.
• It has no access log you can ask who opened what.
• A change to it leaves no trace at the row level.
• It goes on existing after the system that replaced it went live.

That is why moving from spreadsheets to a database is usually pitched as an operational improvement, while the larger gain is simply the ability to answer questions. The practical side of that move is set out in a migration method for forty Excel sheets.

Sources

• Opinion: appointing a privacy protection officer under the requirements of Amendment 13, Privacy Protection Authority
• Israeli Privacy Protection Authority