Israel Privacy Protection Law Amendment 13: what changes for websites hosted abroad
A practical guide for Israeli businesses, developers and agencies deciding where to host a website or app. Status as of 30.09.2026. General information, not legal advice.
Short answer
- 1Amendment 13 to the Privacy Protection Law, 1981 was passed by the Knesset on 8 August 2024 and entered into force on 14 August 2025, according to law-firm summaries.
- 2Those summaries do not describe a rule that forbids hosting a website abroad. Hosting location is not the test; what matters is whose data you process and how you protect it.
- 3The separate 2001 regulations on transferring data from an Israeli database outside Israel are described by law firms as still applying after the amendment.
- 4You stay responsible for the data you collect. A hosting provider gives you infrastructure and a processing contract, not legal compliance.
- 5This page is general information as of 30.09.2026, not legal advice. Confirm the current text with the Privacy Protection Authority or an Israeli lawyer.
What we could and could not verify
The Privacy Protection Authority's pages on gov.il and the Knesset text were not reachable for us when we prepared this page. Everything below comes from summaries published by Israeli and international law firms, for example Pearl Cohen, Herzog Fox & Neeman and DLA Piper. We name them so that you can read the detail yourself. We do not quote section numbers, because we could not check them against the official text.
Timing. The summaries agree that Amendment 13 was passed on 8 August 2024 and took effect on 14 August 2025. One of them reports that the Authority announced a grace period for enforcing the data protection officer duty until 31 October 2025.
Direction of the reform. The firms describe wider definitions, closer alignment with GDPR concepts, stronger enforcement powers and administrative fines for the Authority, and a much smaller group of databases that must be registered. They also describe a reporting duty for some databases that hold highly sensitive data about a large number of people. The thresholds are given in those articles; check them before you rely on them.
Transfers abroad. The Privacy Protection Regulations (Transfer of Data to Databases Outside the Borders of the State), 2001 are described as permitting a transfer from an Israeli database only when conditions are met, for example that the receiving country ensures a level of protection not lower than Israeli law. The same summaries say the amendment's registration relief does not remove this limit. Whether it reaches your website depends on your facts, which is why a lawyer should confirm it.
Why hosting location is only part of the question
For a typical site, the practical questions are the same wherever the server stands. What personal data do you collect? Who can reach it? Is it encrypted in transit and at rest? Do you have a written contract with every company that processes it for you? Can you delete it on request? A server in Frankfurt can support good answers to all of these, and so can a server elsewhere.
One point is plain: 4hosting servers are in the EU, not in Israel. If an Israeli customer, partner or tender requires data to stay in Israel, we are not the right choice for that workload, and you should know that before you sign.
Real-world examples
Tel Aviv online shop on a European VPS
A shop keeps customer names, phone numbers and orders in a PostgreSQL database on a VPS in Frankfurt. The owner lists the database and the processor in an internal register, limits access to two people and keeps encrypted backups. Before launch, an Israeli lawyer checks whether the 2001 transfer regulations apply to this set-up.
Haifa clinic booking site
A clinic's booking form collects health-related details. The team treats this as sensitive information, uses HTTPS everywhere, separates the admin panel behind a VPN and asks a lawyer which duties apply to sensitive data before choosing where to host.
Freelancer with a WordPress portfolio
A designer runs a WordPress site with a contact form on cPanel hosting. She keeps plugins updated, turns on daily backups, adds a privacy notice in Hebrew and deletes old enquiries on a schedule.
Common mistakes
- Assuming a server in Israel is required. The summaries we read do not state this, so check your own case instead of copying a competitor's claim.
- Assuming a server in Europe settles everything. Your duties as the owner of the data do not move with the server.
- Skipping a written agreement with the host or any other processor that touches personal data.
- Collecting more data than the site needs, and never deleting it.
- Treating a provider's security page as a legal opinion about your processing.
How 4hosting helps
Our datacenter is in the EU, in Frankfurt. We offer a data processing agreement (DPA) under GDPR Article 28 and standard contractual clauses for transfers, which gives you a written processor contract to show your lawyer. Every plan includes monthly DevOps, CyberSecurity and Programming hours (from cPanel Advanced upwards; VPS plans include 1 to 8 hours), which you can use for hardening, backups and WAF rules. Migration is free.
4hosting is not a compliance certifier and does not sign legal compliance for you. We hold no ISO, SOC 2 or similar certification; our security practice is aligned with ISO 27001. Learn more about us or contact us about your set-up.
Frequently asked questions
Do I have to host an Israeli website in Israel?
The sources we reviewed do not describe such a requirement. Rules about transferring data outside Israel exist in separate regulations and depend on the facts. Ask an Israeli lawyer or the Privacy Protection Authority about your case.
Where are 4hosting servers?
In the EU: Frankfurt, with points of presence in Frankfurt, London and New York. There are no 4hosting datacenters in Israel, and our IP addresses are European.
Does 4hosting make me compliant with Amendment 13?
No. 4hosting does not certify legal compliance and holds no ISO, SOC 2 or similar certification; we describe our security practice as aligned with ISO 27001. We offer a data processing agreement under GDPR Article 28 and standard contractual clauses for transfers. Compliance of your processing remains your responsibility.