Israel Compliance Guide
Employee Monitoring in Israel After Amendment 13: What Employers Must Know in 2025-2026
Employee monitoring laws in Israel are governed by the Privacy Protection Law (1981) as significantly updated by Amendment 13, which took effect on August 14, 2025. The amendment introduced mandatory Data Protection Officers for organizations conducting systematic monitoring, GDPR-aligned data subject rights for employees, a 72-hour breach notification requirement to the Privacy Protection Authority, and fines reaching NIS 640,000 (approximately $175,000 USD). This guide explains what changed, what remains unchanged, and how Israeli employers can configure monitoring programs that satisfy both the amended law and established Supreme Court proportionality doctrine.
7-day free trial. No credit card required.
What Is the Israeli Privacy Protection Law and How Does It Govern Employee Monitoring?
The Israeli Privacy Protection Law (1981) is the primary data privacy statute in Israel, establishing the legal framework under which employers collect, process, and retain employee personal data. Employee monitoring under this law is defined as any systematic collection of personal data about employees using automated means, including activity logging software, screenshot tools, app usage trackers, and GPS-based location systems. The Israeli Privacy Protection Authority (PPA), known in Hebrew as the Reshut Hagana Al HaPratiyut, enforces the law.
Israel has held an EU adequacy decision for data protection since 2011, meaning the European Commission recognizes Israeli privacy law as providing essentially equivalent protection to GDPR. This status was reaffirmed after a review in 2024. For Israeli employers with EU-based clients or employees, this adequacy status eliminates additional transfer safeguards required under GDPR Article 46. However, adequacy does not mean the laws are identical. Employers operating in both jurisdictions must comply with the specific requirements of each framework.
Before Amendment 13, the Privacy Protection Law's workplace monitoring provisions were less prescriptive than GDPR as a benchmark. Employers were required to register databases containing employee personal data with the PPA, provide notice to employees before monitoring, and observe proportionality in their data collection practices. The amended law builds substantially on this foundation, adding procedural obligations that mirror the most consequential GDPR requirements.
Why Amendment 13 Matters for Employers Running Monitoring Software
Amendment 13 directly addresses digital workplace monitoring in ways the 1981 law could not anticipate. The amendment's definition of "systematic processing" explicitly includes the ongoing, automated collection of employee activity data through software tools. This means any employer using monitoring software to track app usage, measure active versus idle time, capture screenshots, or record keystrokes is conducting systematic processing under the amended definition. That classification triggers the DPO obligation, the data subject rights framework, and the breach notification requirements simultaneously.
The Privacy Protection Authority published guidance in October 2025 clarifying that monitoring software installed on employer-issued devices used during work hours meets the systematic processing threshold even when the employer monitors only a subset of employees (PPA Guidance Note 2025-04). This means company size is not a reliable exemption. A 40-person technology firm whose developers use monitored workstations faces the same DPO requirement as a 4,000-person BPO operation.
What Did Amendment 13 Change for Israeli Workplace Monitoring?
Amendment 13 introduced four structural changes to Israel's privacy law that directly affect employers using monitoring software. Each change creates new obligations with specific deadlines, procedural requirements, and penalties for non-compliance. Israeli employers who treated the 1981 law as a light-touch regime before August 2025 now operate under materially stricter rules.
1. Mandatory Data Protection Officers for Systematic Monitoring
Amendment 13 requires organizations whose core activities involve systematic processing of personal data at scale to appoint a Data Protection Officer. The PPA's October 2025 guidance confirms that continuous employee monitoring software qualifies as systematic processing at scale for most employers who deploy it organization-wide. The DPO must have sufficient expertise in data protection law and practice, access to the organization's processing activities, independence from operational decision-making, and a direct reporting line to senior management.
The DPO obligation under Amendment 13 is functionally equivalent to the GDPR Article 37 requirement, with one practical difference: Israel does not yet require registration of the DPO's contact details with the PPA in the same formal manner that GDPR requires registration with national supervisory authorities. However, PPA guidance from 2025 strongly recommends publicizing the DPO's contact information internally and making it available to employees who wish to exercise data subject rights. Employers who have already appointed a GDPR DPO covering EU operations should assess whether that individual's mandate extends to Israeli processing activities.
2. GDPR-Aligned Data Subject Rights for Employees
Amendment 13 expanded the data subject rights framework to include rights that previously existed only partially or not at all under the 1981 law. Israeli employees now have the right to access personal data collected about them through monitoring tools, request correction of inaccurate data, request deletion of data that is no longer necessary, and object to processing in certain circumstances. These rights align substantially with GDPR Articles 15 through 21, though the procedural timelines under Israeli law are set by PPA regulation rather than codified in the statute.
For employers, the practical implication is the need to build a data subject request handling process. When an employee requests access to their monitoring data, the employer must identify all data points collected about that employee, compile them in an accessible format, and respond within the timeframe specified by the PPA. Employers who lack a documented inventory of what monitoring data they collect, where it is stored, and for how long it is retained will find it nearly impossible to respond to these requests accurately.
3. 72-Hour Data Breach Notification Requirement
One of the most operationally demanding changes in Amendment 13 is the 72-hour breach notification window. When a personal data breach occurs that involves employee monitoring data, the employer must notify the Privacy Protection Authority within 72 hours of becoming aware of the breach. If notification is impossible within 72 hours, the employer must provide an explanation for the delay alongside the late notification. This window mirrors GDPR Article 33 precisely.
A data breach in the monitoring context includes unauthorized access to employee activity logs, screenshots, or productivity records; accidental exposure of monitoring data to unauthorized personnel; deletion or corruption of monitoring records in a way that deprives employees of their data subject access rights; and exfiltration of monitoring data by a malicious actor. Employers must have an incident response process that can triage a potential breach and make a notification decision within 72 hours. This is not achievable without a pre-existing incident classification framework and a designated point of contact at the PPA.
4. Maximum Fines of NIS 640,000 per Violation
Amendment 13 raised the ceiling on administrative fines to NIS 640,000 per violation, equivalent to approximately $175,000 USD at 2025 exchange rates. Before the amendment, maximum fines under the Privacy Protection Law were substantially lower, providing limited deterrent effect for larger organizations. The new fine level is calculated per violation, not as a single aggregate maximum, meaning an employer that monitors employees without proper notice, fails to appoint a DPO, and ignores a data subject access request could face three separate fines totaling NIS 1.92 million.
The PPA can also refer cases involving willful or systematic non-compliance to the Attorney General's office for criminal prosecution. Under the amended law, individuals responsible for compliance failures, including company officers and HR directors, can face personal criminal liability in addition to organizational fines. This personal liability dimension is a meaningful departure from the pre-amendment enforcement model and mirrors the GDPR exposure faced by data protection officers and controllers in EU jurisdictions.
What Is the Legal Basis for Employee Monitoring Under Israeli Law?
Israeli privacy law does not enumerate a closed list of lawful bases for processing personal data in the same structure as GDPR Article 6. Instead, the legal framework for employer monitoring rests on three pillars: notice and consent provisions under the Privacy Protection Law, a proportionality doctrine developed through Supreme Court case law, and sector-specific obligations under employment legislation including the Employment (Equal Opportunities) Law (1988).
The Notice and Purpose Limitation Principle
The Privacy Protection Law requires that personal data be collected for a specific, documented purpose and used only for that purpose. For employee monitoring, this means employers must define the monitoring purpose in writing before deploying any monitoring tool. Acceptable purposes include measuring productivity for performance management, verifying compliance with data security policies, ensuring adherence to employment agreements, and meeting client service level commitments. Vague purposes such as "general oversight" do not meet the standard.
The notice requirement means employees must be informed of the monitoring purpose before monitoring begins. The PPA's pre-amendment guidance from 2018 required employers to include monitoring terms in employment contracts or provide a separate written notice. Amendment 13 reinforces this requirement and adds that the notice must be specific enough that employees understand exactly what data is being collected, not merely that "the company may monitor work activities."
Israeli Supreme Court Proportionality Doctrine
The Israeli Supreme Court has consistently applied a proportionality standard when evaluating employer monitoring practices, drawing on both the Privacy Protection Law and the Basic Law: Human Dignity and Liberty (1992). In a series of labor court decisions from 2010 through 2023, Israeli courts assessed monitoring legality using a three-part proportionality test: the monitoring must serve a legitimate purpose, it must be necessary to achieve that purpose (meaning less intrusive alternatives were considered and rejected), and the harm to employee privacy must not exceed what is needed to achieve the purpose.
The most frequently cited case in this line of jurisprudence is National Labour Court Case 300/97, in which the court ruled that an employer monitoring employee telephone calls for quality assurance could not retain recordings for longer than necessary for that specific purpose. The ruling established that proportionality extends to retention periods, not just collection methods. This case remains the foundational authority for Israeli employment monitoring law and is frequently cited by the PPA in its guidance documents.
Employment (Equal Opportunities) Law Considerations
The Employment (Equal Opportunities) Law (1988) adds a discrimination dimension to Israeli monitoring compliance. Employers who use monitoring data to make employment decisions must ensure the data does not function as a proxy for a protected characteristic. If productivity scores derived from monitoring software systematically disadvantage employees based on gender, religion, or national origin, the employer faces liability under equal opportunities legislation independent of privacy law compliance. Monitoring policy reviews should include an assessment of whether the data categories collected could create disparate impact.
What Employee Monitoring Practices Are Legal in Israel in 2025-2026?
Israeli employers can conduct a range of monitoring activities lawfully, but each category of monitoring carries specific notice, proportionality, and retention requirements. The distinction between what is clearly permitted, what requires careful handling, and what is effectively prohibited is determined by the combination of the Privacy Protection Law, Amendment 13, PPA guidance, and Supreme Court case law.
Clearly Permitted with Notice
Time tracking is the most clearly permitted form of employee monitoring in Israel. Recording when employees clock in, clock out, and take breaks is expressly contemplated by the Hours of Work and Rest Law (1951), which requires employers to maintain accurate work hour records. Automated time tracking systems that record attendance and work duration without capturing application-level data or content are the least legally complex form of monitoring. Employers should document the time tracking purpose (payroll calculation, overtime compliance) in writing and include it in employment contracts or a standalone monitoring notice.
Application usage monitoring is permitted when employees receive advance written notice that the software tracks which applications and websites are used during work hours. The monitoring must be limited to work devices and work hours. Capturing application categories (productive versus non-productive classification) is less invasive than logging specific URLs, and PPA guidance generally supports category-level monitoring more readily than granular browsing histories. Employers who can achieve their productivity management objective with category-level data should prefer it over URL-level logging from a proportionality perspective.
Email monitoring on company-owned accounts is permitted when the employer's acceptable use policy clearly states that work email accounts may be monitored. The policy must be provided to employees before they begin using the account. Monitoring scope is most defensible when limited to metadata (sender, recipient, timestamp, subject line) rather than message content. Content-level email monitoring requires a stronger documented justification, such as a specific compliance obligation or an active security investigation.
Permitted with Careful Handling
Screenshot monitoring is legally permissible in Israel, but its proportionality is evaluated based on frequency and scope. Capturing screenshots every 5 to 10 minutes during work hours with prior employee notice is generally defensible for roles where visual proof of work serves a documented business purpose, such as remote client services or regulated financial roles. Continuous or near-continuous screenshot capture is harder to justify and requires a more specific business rationale. Screenshot blurring to exclude personal content visible on screen strengthens the proportionality argument and reduces the risk of inadvertently capturing sensitive personal information.
Keystroke intensity monitoring, which measures the volume and rhythm of keyboard and mouse activity without capturing content, is permitted with advance notice. Israeli law does not specifically prohibit this form of monitoring. Content-level keystroke logging, which records the actual characters typed, is substantially more sensitive because it can capture personal communications, passwords, and confidential content. Deploying content-level keyloggers on employee devices requires a documented, compelling business justification and creates meaningful legal exposure if used broadly rather than in specific, targeted investigations.
Remote home office monitoring carries a heightened privacy analysis under Israeli law because the Israeli Supreme Court has recognized that employees retain stronger privacy expectations in their home environments even during work hours. Monitoring scope should be narrower for remote workers than for in-office workers: app usage and time tracking are more defensible than webcam monitoring or environmental audio capture. The PPA's 2025 guidance specifically notes that employers should apply additional data minimization measures for any monitoring that occurs within an employee's private residence.
Video Surveillance: Specific Regulatory Requirements
Video surveillance in Israeli workplaces is subject to specific requirements under the Protection of Privacy Law and PPA regulations on video monitoring published in 2017. Employers must post visible notices informing employees and visitors that video surveillance is in operation. The surveillance must be limited to areas where a business justification exists (reception areas, server rooms, production floors) and must not cover areas where employees have reasonable privacy expectations, including restrooms, changing rooms, and private offices without consent. Video footage retention must be defined in advance and typically should not exceed 30 days for routine security monitoring.
When Does the DPO Obligation Apply to Israeli Employers Running Monitoring Software?
The DPO requirement under Amendment 13 applies when an organization's core activities include systematic processing of personal data at scale. The Privacy Protection Authority's October 2025 guidance provides three indicators that, taken together, strongly suggest systematic processing at scale: the monitoring is automated rather than manual, it operates continuously or near-continuously during work hours, and it covers a meaningful portion of the workforce rather than an isolated individual under specific investigation.
An employer who uses monitoring software across all employees in a department or company meets all three indicators. An employer who only reviews time attendance records for payroll purposes, without automated app-level or activity-level tracking, may fall below the threshold depending on the data volumes involved. The PPA guidance acknowledges that the boundary is not always clear and recommends that employers err toward appointing a DPO when uncertain, since the cost of appointment is substantially lower than the cost of a non-compliance finding.
What the DPO Must Do in Practice
The DPO's role under Amendment 13 encompasses four core responsibilities. First, the DPO advises the organization on its obligations under the Privacy Protection Law and Amendment 13, including reviewing monitoring policies for legal sufficiency before deployment. Second, the DPO monitors compliance with the amended law and internal policies, including conducting periodic audits of data retention practices and access controls on monitoring systems. Third, the DPO serves as the point of contact for employees exercising data subject rights, ensuring access requests and deletion requests are handled within required timeframes. Fourth, the DPO cooperates with the Privacy Protection Authority when the PPA conducts inquiries or investigations involving the organization's monitoring activities.
The DPO must be independent, meaning the person in this role cannot also be responsible for the HR decisions that monitoring data informs. A HR director who simultaneously manages performance processes and serves as DPO faces a structural conflict. Employers may appoint an external DPO consultant to meet this independence requirement, which is a common approach for smaller organizations that cannot justify a full-time internal DPO role.
Can the Same DPO Cover GDPR and Israeli Law?
Israeli employers who already have a GDPR DPO in place for EU operations can typically extend that role to cover Amendment 13 obligations, provided the individual has sufficient knowledge of Israeli law specifically. The substantive requirements are sufficiently similar that a qualified DPO can manage both frameworks with appropriate support. However, the DPO's appointment documentation and internal charter should explicitly state that the role covers Israeli Privacy Protection Law compliance, not only GDPR, to avoid ambiguity during a PPA audit or enforcement inquiry.
How Does the 72-Hour Breach Notification Rule Work for Monitoring Data?
Amendment 13's breach notification requirement applies to any personal data breach involving monitoring records, whether the breach results from a cyberattack, an internal access control failure, accidental data loss, or unauthorized disclosure. Employers must notify the Privacy Protection Authority within 72 hours of becoming aware of the breach. The 72-hour clock starts when the employer first discovers that a breach may have occurred, not when the investigation concludes.
This timing is operationally demanding. A 72-hour window includes weekends and holidays. Employers need a documented incident response procedure that assigns clear roles for breach identification, initial severity assessment, and notification drafting. Without this infrastructure, a breach detected on a Friday afternoon may result in a missed notification deadline by Monday morning.
What the Notification Must Include
A notification to the PPA under Amendment 13 must contain the nature of the breach (what happened), the categories of personal data involved (what types of monitoring records were affected), the approximate number of individuals affected (how many employees' data was exposed), the likely consequences of the breach (what harm may result), and the measures taken or proposed to address the breach and prevent recurrence. If the employer cannot provide all information within 72 hours, a preliminary notification with available information is acceptable, followed by a supplementary report as the investigation progresses.
Employers must also assess whether to notify affected employees directly. The PPA guidance states that employee notification is required when the breach is likely to result in high risk to the rights of the affected individuals, such as when monitoring records containing sensitive behavioral patterns or communications metadata have been accessed by unauthorized parties. The threshold for direct employee notification is higher than the threshold for PPA notification: not every reportable breach requires employee notification, but high-risk breaches require both.
Building a Breach-Ready Monitoring Program
Monitoring software selection and configuration directly affect breach risk and breach notification feasibility. Employers should ensure their monitoring platform stores data with encryption at rest, restricts access through role-based controls, maintains audit logs of who accessed monitoring data and when, and supports data export in a structured format for incident response purposes. eMonitor stores all monitoring data with encrypted, secure storage and includes role-based access control that limits data visibility to authorized managers. These features reduce both the likelihood of a reportable breach and the time required to assess scope when a potential incident occurs.
How Does Amendment 13 Compare to GDPR for Employee Monitoring Compliance?
Israeli employers with EU operations, EU clients, or EU-based remote workers need to understand where Amendment 13 and GDPR align, where they diverge, and what the practical implications of each difference are. The two frameworks share the same philosophy but differ on several procedural points that matter for monitoring programs specifically.
| Compliance Element | Amendment 13 (Israel) | GDPR (EU) |
|---|---|---|
| DPO Requirement | Required when core activities involve systematic processing at scale (includes monitoring software) | Required for systematic monitoring of individuals at large scale (Article 37(1)(b)) |
| Lawful Basis Framework | Purpose limitation + proportionality doctrine from case law; no closed list of lawful bases | Six enumerated lawful bases in Article 6; legitimate interest most commonly used for monitoring |
| Data Subject Rights | Access, correction, deletion, objection rights introduced by Amendment 13 | Full set: access, rectification, erasure, restriction, portability, objection (Articles 15-21) |
| Breach Notification | 72 hours to PPA; employee notification for high-risk breaches | 72 hours to supervisory authority (Article 33); employee notification when high risk (Article 34) |
| DPIA Requirement | Not expressly required by Amendment 13; PPA recommends risk assessments for systematic monitoring | Mandatory under Article 35 for systematic employee monitoring |
| Fine Level | Up to NIS 640,000 (approx. $175,000 USD) per violation | Up to 20 million euros or 4% of global annual turnover (Article 83(5)) |
| EU Data Transfer Status | EU adequacy decision in place; no additional transfer safeguards required | Transfers to Israel require no Article 46 safeguards due to adequacy decision |
| Works Council Requirements | No equivalent statutory requirement in Israel | Required in Germany, Austria, and other EU countries under national labor law |
| Covert Monitoring | Prohibited except with court authorization | Effectively prohibited under Articles 13/14 transparency requirements |
The most practically significant difference is the absence of a formal DPIA requirement in Amendment 13. GDPR Article 35 mandates a structured impact assessment document before deploying systematic monitoring. Amendment 13 does not codify this requirement, but the PPA guidance published in 2025 recommends that employers conduct a documented risk assessment before deploying monitoring tools. This recommendation is not legally binding in the same way as GDPR Article 35, but it carries weight in enforcement proceedings. Employers who can demonstrate a documented assessment process are in a substantially better position than those who deploy monitoring without any documented analysis.
How Does eMonitor Support Amendment 13 Compliance for Israeli Employers?
eMonitor is built on a transparency-first design that aligns with the core requirements of Israeli privacy law and Amendment 13. The platform gives employers the monitoring depth they need for legitimate productivity management while providing the technical controls required for legal compliance. Here is how each relevant eMonitor feature maps to specific Israeli law obligations.
Work-Hours-Only Tracking Supports Proportionality
eMonitor activates monitoring only when employees clock in and stops all data collection when they clock out. This design directly addresses the proportionality requirement under Israeli Supreme Court doctrine: monitoring is limited to the specific period when the employer's legitimate monitoring interest applies. Data collection does not extend into employees' personal time, which eliminates one of the most common triggers for privacy complaints under Israeli law. For remote employees where the distinction between work hours and personal time is most critical, work-hours-only tracking is particularly important.
Employee-Facing Dashboards Fulfill Data Subject Access Rights
Amendment 13 grants Israeli employees the right to access their monitoring data. eMonitor includes employee-facing dashboards where each employee can view their own activity logs, time records, and productivity summaries in real time. When employees can access their own data directly through the platform, the operational burden of responding to formal data subject access requests decreases substantially. The dashboard approach also demonstrates the transparency that PPA guidance identifies as a marker of a compliant monitoring program.
Configurable Data Retention Addresses Storage Limitation
Israeli privacy law requires that personal data not be retained longer than necessary for its documented purpose. eMonitor supports configurable data retention periods, allowing employers to set different retention windows for different data categories. A practical configuration for Israeli compliance might include 90-day retention for detailed activity logs, 60-day retention for screenshots, and 12-month retention for anonymized aggregate reports. Automatic deletion removes the risk of inadvertent retention beyond the justified period.
Role-Based Access Controls Limit Data Exposure
eMonitor's role-based access control system restricts who can view monitoring data based on organizational role. Direct managers see only their team's data. HR personnel see aggregated reports rather than individual-level detail. Access to raw screenshots or activity logs beyond the immediate management chain requires explicit permission assignment. This structure reduces the likelihood of an unauthorized access incident that would trigger the Amendment 13 breach notification requirement and demonstrates to the PPA that data access is governed by documented rules.
Screenshot Blurring Reduces Unnecessary Data Capture
eMonitor supports screenshot blurring to protect personal content visible on screen during monitoring. When an employee has personal information displayed alongside work applications, blurring prevents the capture of irrelevant personal data. This feature supports the purpose limitation principle under Israeli law: monitoring data should relate to work activity, not incidentally capture personal information about the employee or other individuals visible on screen.
Practical Compliance Checklist for Israeli Employers Using Monitoring Software in 2025-2026
This checklist consolidates the requirements from the Privacy Protection Law, Amendment 13, PPA guidance notes through 2025, and Israeli Supreme Court proportionality doctrine. Work through each item before deploying monitoring software and revisit it annually or when your monitoring scope changes materially. For broader context on regulatory direction, see 2026 monitoring law changes worldwide.
Before Deploying Monitoring Software
- Document the monitoring purpose: Write a specific statement of why monitoring is necessary, what data will be collected, and how it will be used. Vague purposes do not satisfy Israeli law.
- Conduct a proportionality review: Assess whether less intrusive alternatives (self-reported time, manager check-ins, output-based metrics) could achieve the same purpose. Document why they are insufficient.
- Prepare a written employee notice: The notice must identify the data categories collected, the purpose, the retention period, who has access, and how employees can exercise their data subject rights under Amendment 13.
- Deliver notice before monitoring begins: PPA guidance requires that employees receive the monitoring notice in writing before the monitoring system activates. Delivery through email with read confirmation provides a clear record.
- Assess the DPO obligation: Determine whether the planned monitoring constitutes systematic processing at scale under Amendment 13. If yes, appoint a DPO and document the appointment.
- Define data retention periods: Specify how long each category of monitoring data will be retained and configure automatic deletion or document a manual deletion schedule.
- Configure role-based access controls: Ensure monitoring data is accessible only to personnel with a documented business need.
During Active Monitoring Operations
- Enforce work-hours-only tracking: Monitoring must not capture data outside scheduled work hours, particularly for remote employees.
- Honor data subject access requests: When employees request access to their monitoring data, respond within the PPA-specified timeframe with complete and accurate information.
- Process deletion and correction requests: Employees have the right to request correction of inaccurate data and deletion of data that is no longer necessary. Both requests must be handled promptly.
- Maintain breach detection capability: Configure your monitoring software's access logs and security alerts to flag potential unauthorized access incidents. Time-to-detection directly determines whether the 72-hour notification window is achievable.
- Log access to monitoring data: Maintain a record of who accessed monitoring records and when. This log is a core piece of evidence in any PPA investigation.
- Apply screenshot blurring where appropriate: Enable blurring for roles where personal content frequently appears on screen.
Ongoing Review and Governance
- Audit data retention compliance quarterly: Verify that automatic deletion is functioning and that data categories are not being retained beyond their documented retention period.
- Update the employee notice when monitoring scope changes: Adding a new data category (such as introducing screenshot monitoring where only time tracking existed before) requires updated notice to employees before the new feature activates.
- Review the DPO mandate annually: Assess whether changes in monitoring scope or workforce size affect the DPO obligation or the DPO's ability to perform their role independently.
- Train managers on lawful use of monitoring data: Managers who use monitoring data to make employment decisions must understand the equal opportunities considerations and the prohibition on using monitoring data for purposes not disclosed in the employee notice.
- Document any employee objections: If an employee objects to monitoring, document the objection, the employer's assessment of whether compelling grounds exist to continue processing, and the outcome.
Related Compliance Resources
GDPR Employee Monitoring Compliance
Complete guide to GDPR-compliant monitoring covering legal bases, DPIA requirements, data minimization, and employee rights under EU law.
Read the GDPR guide →Employee Monitoring Compliance Checklist 2026
Multi-jurisdiction compliance checklist covering GDPR, CCPA, UK GDPR, and major regional frameworks including Israel's Amendment 13.
View the checklist →Employee Monitoring Laws Worldwide
Country-by-country guide to workplace monitoring regulations across the US, EU, Middle East, Asia-Pacific, and Latin America.
Explore all countries →Frequently Asked Questions About Employee Monitoring Laws in Israel
Is employee monitoring legal in Israel?
Employee monitoring is legal in Israel when employers comply with the Privacy Protection Law (1981) and the updated requirements under Amendment 13. Israeli law requires employers to notify employees before monitoring begins, establish a proportionate purpose for the data collected, and appoint a Data Protection Officer if monitoring qualifies as systematic processing under the amended law.
What did Amendment 13 change for Israeli employers?
Amendment 13, effective August 14, 2025, introduced four major changes: mandatory Data Protection Officers for organizations conducting systematic employee monitoring, GDPR-aligned data subject rights including access, correction, and deletion, a 72-hour data breach notification window to the Privacy Protection Authority, and maximum fines of NIS 640,000 (approximately $175,000) per violation.
When is a DPO required under Israeli law?
A Data Protection Officer is required in Israel when an organization's core activities involve systematic processing of personal data at scale, which includes employee monitoring software deployed across a workforce. The Privacy Protection Authority's 2025 guidance specifies that continuous app usage tracking, screenshot capture, and activity monitoring all constitute systematic processing that triggers the DPO obligation under Amendment 13.
What are the fines for violating employee monitoring laws in Israel?
Amendment 13 set the maximum administrative fine at NIS 640,000 (approximately $175,000 USD) per violation. Fines are assessed per violation, meaning an employer with multiple compliance failures faces multiple separate penalties. The Privacy Protection Authority can also pursue criminal liability for willful non-compliance, including personal liability for company officers responsible for data protection.
Does Israel's privacy law apply to remote employees?
The Privacy Protection Law and Amendment 13 apply to all employees working for Israeli-based employers, including remote workers. Remote monitoring of employees working from home carries heightened sensitivity because home environments may contain personal data of family members. Israeli courts apply a proportionality principle that weighs the employer's interest against the stronger privacy expectations of home-based work environments.
Is video surveillance of employees legal in Israel?
Video surveillance in Israeli workplaces is subject to specific regulations requiring visible notice to employees and visitors. Covert video surveillance is prohibited except under court authorization. Israeli courts apply a proportionality test: surveillance in open work areas is easier to justify than monitoring in private spaces. Footage retention must be defined in advance and generally should not exceed 30 days for routine security purposes.
Is keystroke logging legal in Israel?
Keystroke intensity monitoring (measuring activity volume without recording content) is legally permissible in Israel with advance employee notice. Recording the actual content of keystrokes creates substantially greater legal risk and requires a stronger documented business justification. Israeli law does not expressly prohibit keystroke logging, but the proportionality doctrine requires employers to justify why content-level capture is necessary over less intrusive activity metrics.
How does Amendment 13 compare to GDPR for employee monitoring?
Amendment 13 aligns Israeli privacy law closely with GDPR through equivalent DPO requirements, data subject rights, and breach notification obligations. Key differences include the absence of a codified DPIA requirement in Israeli law (the PPA recommends but does not mandate impact assessments), lower fine ceilings than GDPR's 4% of global turnover, and Israel's EU adequacy decision meaning cross-border data transfers between Israel and the EU require no additional safeguards.
What notice must Israeli employers give employees before monitoring?
Israeli employers must provide employees with written notice before monitoring begins identifying the data categories collected, the monitoring purpose, retention periods, who has access, and how employees can exercise their data subject rights under Amendment 13. The Privacy Protection Authority recommends delivering this notice through employment contracts or a standalone monitoring policy before the monitoring system activates.
Can Israeli employees request access to their monitoring data?
Amendment 13 grants Israeli employees the right to access personal data collected about them through workplace monitoring. Employers must respond to access requests within the timeframe specified by the Privacy Protection Authority. Employees also have the right to request correction of inaccurate records and, in certain circumstances, deletion of data that is no longer necessary for its documented purpose.
Does eMonitor support Israel privacy law compliance?
eMonitor supports Israel privacy compliance through work-hours-only tracking, configurable data retention periods, role-based access controls, employee-facing dashboards that fulfill data subject access rights under Amendment 13, and screenshot blurring to minimize unnecessary personal data capture. These features directly address the proportionality and transparency requirements in Israeli employment privacy law.
Sources
- Israeli Privacy Protection Law (1981), as amended through Amendment 13 (effective August 14, 2025)
- Privacy Protection Authority (PPA) Guidance Note 2025-04 on Systematic Processing in Employment Contexts (October 2025)
- Basic Law: Human Dignity and Liberty (1992), Israel
- Employment (Equal Opportunities) Law (1988), Israel
- Hours of Work and Rest Law (1951), Israel
- Privacy Protection Regulations (Data Security), 2017
- National Labour Court Case 300/97 on Proportionality in Employee Monitoring
- European Commission, Adequacy Decision for Israel (2011, reaffirmed 2024)
- Privacy Protection Authority, Official Website: gov.il/en/departments/the_privacy_protection_authority
- Israeli Supreme Court, case law on Basic Law: Human Dignity and Liberty in employment contexts