israeli-privacy-shieldlisted

# Israeli Privacy Shield ## Critical Note This skill provides compliance GUIDANCE. It does not replace legal counsel. Recommend consulting a privacy attorney (orech din specializing in prati'ut) for specific compliance decisions. ## Instructions ### Step 1: Assess Security Level The 2017 regulations define three security levels: | Level | Criteria | Key Requirements | |-------|----------|-----------------| | Basic | < 10,000 records, non-sensitive | Access controls, logging, backup | | Medium | 10,000+ records OR sensitive data | + Encryption, security officer appointment | | High | Government, health, financial, 100K+ records, or authorized access for 100+ people | + Incident response plan, DPO, plus a security risk assessment and a penetration test at least once every 18 months with documented findings and remediation | Sensitive data includes: Health, genetics, sexual orientation, political views, criminal record. ### Step 2: Database Registration Check Under the Amendment 13 regime, registration with the Privacy Protection Authority (PPA) is required only if: - Database owned or managed by a public body, OR - Database contains data on 10,000+ individuals AND the primary purpose is collecting and disclosing personal data to third parties as a business or for value (data brokers) The broad pre-Amendment requirement covering any database with sensitive data (and the old "Form 1" five-trigger list) no longer applies. **Notification tier (separate from registration).**