Data Processing Agreement in Israel: Template, Key Clauses and Local Law (2026)

What a data processing agreement is, in one line A data processing agreement (DPA) is the contract that sets the rules when one party (the controller) hands personal data to another party (the processor) to handle on its behalf. Think of a company using an Israeli payroll bureau, a cloud host, or an analytics vendor. The controller decides why and broadly how the data is used; the processor acts on the controller's instructions. If you only read one thing: in Israel a DPA is the document that proves the controller stayed in control of the data even after it left the building. It is not legal advice, and a short note at the end explains where to get that. ## Do you need a DPA in Israel? Israel's privacy regime changed in a big way. Amendment 13 to the Protection of Privacy Law, 5741-1981 took effect on 14 August 2025 and reshaped the law around a controller and processor model that looks much closer to the EU GDPR than the old database-owner language did. You almost certainly need a written DPA when: - You give a supplier access to personal data you are responsible for (customers, employees, users).

• You are the supplier processing someone else's personal data as a service.
• Data moves outside Israel to a cloud region or a sub-processor abroad. Two layers of Israeli rule drive the content: 1. Protection of Privacy Law, 5741-1981 (as amended by Amendment 13). It defines the controller and processor roles, narrows which databases must be registered, and gives the Privacy Protection Authority (PPA) broader investigation and enforcement powers, with monetary penalties that can reach a percentage of annual turnover.

2. Privacy Protection (Data Security) Regulations, 5777-2017. These set concrete security duties by database sensitivity level and already require a written arrangement with an outsourcing processor that defines the permitted use, security obligations, and audit rights. Because the sources disagree on the exact notification thresholds introduced by Amendment 13 (one summary says databases of more than 100,000 subjects, another cites a lower figure), confirm the current threshold with the PPA's guidance or Israeli counsel before you rely on a number. ## The key clauses an Israeli DPA should contain A workable DPA covers the following. Most of these map directly to the Data Security Regulations and the amended Law. ### 1. Subject matter and roles Name who is controller and who is processor, the categories of data subjects, the types of personal data, and the purpose. Make clear the processor acts only for the controller. ### 2. Processing only on instructions The processor processes personal data only on the controller's documented instructions and for no other purpose. This is the clause that keeps the controller in control under the amended Law. ### 3. Security measures Tie the processor to the Data Security Regulations, 5777-2017, matched to the database's security level (basic, medium, or high). Cover access control, encryption where appropriate, logging, and incident handling. ### 4. Breach notification The processor must tell the controller about a security incident without undue delay so the controller can meet its own reporting duties to the PPA and, where relevant, to affected individuals. ### 5. Sub-processors State whether sub-processors are allowed, require prior approval or notice, and flow the same duties down to them. List known sub-processors in a schedule. ### 6. Cross-border transfers If data leaves Israel, address the Privacy Protection (Transfer of Data to Databases Abroad) Regulations and the conditions that let data go to a given country or recipient. Israel has historically relied on its EU adequacy status to ease EU transfers; keep the clause general and verify the current transfer basis. ### 7. Data subject rights and assistance The processor helps the controller answer access and correction requests, since individuals hold those rights against the controller. ### 8. Audit and records The controller can audit or request evidence of compliance. The processor keeps records of processing on the controller's behalf. ### 9. Return or deletion On termination, the processor returns or deletes the personal data and existing copies, subject to any retention the law requires. ### 10. Liability, term, and governing law Allocate liability for privacy breaches, set the term to match the main services contract, and choose Israeli law and forum where appropriate. ## A simple DPA structure you can reuse 1. Parties and roles (controller, processor)
3. Definitions (align with the Protection of Privacy Law)
4. Scope and purpose of processing
5. Processor obligations (instructions, security, confidentiality)
6. Sub-processors
7. Cross-border transfers
8. Breach notification
9. Assistance with data subject rights
10. Audit rights
11. Return or deletion on termination
12. Liability and indemnity
13. Term, termination, governing law
14. Schedules: data categories, security level, sub-processor list ## Common mistakes - Treating the old database-registration logic as the whole picture. Amendment 13 moved the weight onto controller and processor duties, not just registration.

• Leaving security vague. The Data Security Regulations expect measures matched to a defined sensitivity level, not a generic promise.
• Forgetting the sub-processor chain, so data ends up abroad with no contract behind it.
• Copying an EU GDPR DPA word for word. The concepts are close after Amendment 13, but the statute, the regulator, and the transfer rules are Israeli and should be named as such. ## Keeping every DPA consistent across your contracts Most teams do not sign one DPA. They sign dozens, each with a slightly different security schedule, sub-processor list, and breach-notice window, and then lose track of which supplier agreed to what. The work of drafting from a house template, checking each DPA against the Data Security Regulations, spotting the clause that drifted, and remembering the audit you promised to run is work that can live in one AI contract workspace instead of a folder of near-identical documents. Adira is an AI legal operating system that drafts, reads, and tracks contracts in one place, tuned to how your company contracts and built on frontier AI; its deepest jurisdiction support today is India, with other jurisdictions including Israel on the roadmap, so treat local-law depth as something to confirm. ## Not legal advice This page explains how data processing agreements generally work under Israeli law as of 2026. It is not legal advice, and privacy rules change. Amendment 13 is recent and its thresholds and guidance are still settling, so confirm the current position with the Privacy Protection Authority's materials or a qualified Israeli lawyer before you sign.