AI and Amendment 13 to Israel's Privacy Protection Law: What a Business Should Check Before Connecting an AI Agent

Tuesday, 2:40 PM

The owner of a small business opens a customer spreadsheet: names, phone numbers, order history, notes on each person. She plans to upload it to an AI agent that will prepare reminders and answer inquiries. The file is already selected. The mouse is over the "Upload" button.

Just before the file goes up, it's worth asking: whose information is this, and what is allowed to be done with it?

That's the question Amendment 13 to Israel's Privacy Protection Law made more important. It took effect on August 14, 2025, and it wasn't written for AI agents. But an agent that reads, copies and sends information about customers does exactly what the law defines as "processing personal information."

This guide is about Israeli law, for readers doing business in or with Israel. We went through the text of the law and the publications of the Israeli Privacy Protection Authority, and turned them into a checklist for a small business. As in our article on Muse and privacy, we separate what we checked in an official source from what is still open. If you operate elsewhere, the rules that apply to you are your own country's, so check them locally. The questions in the checklist are useful anywhere.

In short

Amendment 13 to Israel's Privacy Protection Law has been in force since August 14, 2025. According to the Privacy Protection Authority, it includes, among other things, a narrower duty to register databases, a duty to appoint a privacy protection officer in certain bodies, financial sanctions and new criminal offenses.
Most small businesses are not required to register or appoint an officer, but the core duties apply to them: process information only for its purpose, secure it, inform people and honor requests to access and correct. The exact classification of your business should be checked by a professional.
Connecting an AI agent is processing personal information. What the agent sees, where the information is stored and who approves actions: those are the three questions to answer before connecting.
The practical rule: less information, fewer permissions, a defined vendor, an action log and human approval for anything that goes out.

What changed in Amendment 13 to the Privacy Protection Law, and what of it touches a small business?

The bottom line: the amendment eased database registration but increased enforcement. Financial sanctions and oversight by the Authority are now part of the picture.

According to the Authority's professional guide, the amendment updates substantive definitions in the law, narrows the duty to register databases, adds a duty to notify about large databases holding sensitive information, requires certain bodies to appoint a privacy protection officer, and adds a mechanism of financial sanctions and new criminal offenses. It also says that the shortened limitation period for privacy violations was abolished.

Based on the Privacy Protection Authority's pages on gov.il and the text of the law. The public recommendations document on AI agents is not a binding guideline.

What matters for a small business is the difference between duties that apply only to certain bodies and duties that apply to anyone who processes personal information. The table below summarizes them, per the text of the law, and shows where your business probably belongs. "Probably," because the final classification is a matter for professional review.

Topic	What the law says	Who it applies to
Registering a database (Section 8A(a))	A database must be registered if its main purpose is collecting personal information in order to pass it to others, as a business or for payment, and it holds information on more than 10,000 people. Also if the controller is a public body	Data brokers and public bodies. Not an ordinary business managing its customers
Notifying the Authority (Section 8A(b))	A database not required to register, which holds information of special sensitivity on more than 100,000 people: notice to the Authority within 30 days	Controllers of large databases with sensitive information
Privacy protection officer (Section 17B1)	Required in public bodies, data brokers, bodies whose activity involves regular and systematic monitoring on a significant scale, and bodies that process sensitive information on a significant scale	Four defined categories
Information security (Section 17)	A controller and a holder are each responsible for information security. The detail is in the Data Security Regulations, which divide databases into three levels	Anyone who holds a database
Informing (Section 11)	A request to a person for personal information must come with a notice: the purpose, to whom it will be given, whether providing it is mandatory, and the controller's details	Anyone who collects information for processing in a database
Individual rights (Sections 13 and 14)	The right to inspect information about oneself, and to request correction or deletion if the information is not correct, complete, clear or up to date	Every database controller

Aug 14, 2025Amendment 13 to the Privacy Protection Law takes effect

10,000people: the registration threshold for a database whose purpose is passing information to others

100,000people with sensitive information: the threshold for notifying the Authority about a database not required to register

Sources: the Privacy Protection Authority's professional guide (gov.il) and the text of the Privacy Protection Law, Section 8A, in the version current as of August 14, 2025.

Does the law apply to an AI agent? And what does the Authority say

The bottom line: no special section on artificial intelligence is needed. It's enough that the agent reads or sends personal information for the law to apply.

The law defines "processing" as "any action performed on personal information," including receiving, collecting, storing, copying, viewing, transferring and granting access. Personal information is data relating to an identified person or a person who can be identified, even indirectly. And a customer spreadsheet that includes more than contact details is, by definition, a "database" if it is processed digitally. So uploading such a file to an agent is processing, and duties attach to it.

Two parts of the law bear directly on an agent. Section 8(b): personal information in a database is not processed except for the purpose set for it lawfully. And Section 8(c): personal information from a database is not processed without authorization from the controller, or beyond an authorization. When you define for the agent "what it's allowed to do," you are in effect implementing this section.

What has the Authority itself said about AI? Two official publications, both with a caveat:

A draft guideline from April 28, 2025 on the application of the Privacy Protection Law to artificial intelligence systems. The document's title defines it as a draft, and the public was invited to comment during summer 2025. According to the summaries we found of the Authority's page, the draft states that the law applies at every stage of a system's life, and among other things that a legal basis is required for processing and that consent must be informed. We found no confirmation that a final version was published, so we treat it as a direction, not an obligation.
A recommendations document to the public on using AI agents, published in 2026. According to secondary reports, it recommends limiting the information exposed to the agent, restricting permissions to read-only when possible and keeping human oversight over actions that can't be reversed. It was apparently written for private users, and it is not a binding instruction. Its full text is worth reading directly on the Authority's site.

These recommendations are similar to what we recommend anyway, and they suit businesses too. But to be fair: they are not a "certification," and following them doesn't guarantee compliance with the law.

What the agent touches: the path of information through an agent

The bottom line: every point on the path is a decision. Whoever marks them in advance usually finds that half the information doesn't need to reach the agent at all.

The image worth remembering: an AI agent is a courier who enters your archive. The question isn't whether the courier is trustworthy, but which drawers you gave him a key to, what he copies on the way, and where he hands over what he copied.

The general path of information through an AI agent. The stage in gold is the one where human approval is worth having.

The risk against the action: what to do about each one

The bottom line: most risks are solved by one decision at setup time, not by handling them after the fact.

Six risks of connecting an agent to customer data

Sensitive information that gets in by accident

The risk: emails and spreadsheets also hold information on health, salary, financial activity or information under a duty of confidentiality
The action: exclude mailboxes, folders and columns. Start only with the data the task needs

Broad permissions

The risk: access to the whole mailbox or the whole system, when the task needs a small part
The action: a dedicated account for the agent, read-only at first, a written list of valid permissions, and revocation the moment the need ends

A vendor with unclear storage

The risk: the information passes to a server and a third party without your having decided it
The action: a short questionnaire to the vendor and a written agreement. Check storage location, use for training, deletion and who is authorized to access

Customers who don't know

The risk: a customer doesn't know an AI agent is handling their inquiry or their information
The action: update the collection notice and the privacy policy, and say clearly when it's an agent

No action log

The risk: you can't tell what the agent read, wrote or sent
The action: a log that records every significant action, kept in a secure place, with regular review

A request to access or delete

The risk: a customer asks to see or delete information, and it's scattered across systems and the agent's conversations
The action: a written procedure: who handles it, where to search, and how to delete from the vendor's storage too

The list of information of special sensitivity is based on the definition in Section 3 of the Privacy Protection Law. The table's purpose is to map questions, not to make a legal determination.

A checklist before you connect an AI agent: eight topics

The bottom line: first decide what the agent will see, and only then connect. The reverse is the order that creates problems.

Map the information. Write down which personal data the agent will touch: names, phone numbers, purchase history, correspondence. Mark which of it is sensitive. The law lists, among other things, information on health, information on salary and financial activity, biometric identifiers, origin, political opinions or religious beliefs, certain location data and information under a legal duty of confidentiality.
Minimize. Pass the agent only what the task needs. The Data Security Regulations require a controller to examine, and to document that it examined, that the database doesn't hold much more information than its purposes require. An agent is a good reason to run that check.
Permissions. A dedicated account for the agent, read-only by default, and permissions by task. The regulations require setting access permissions, keeping an updated list of them, and revoking a permission when the holder leaves the role.
Vendors and agreements. Who processes the information, and where? The law defines a "holder" as an external party that processes information on behalf of the controller, and places responsibility for security on it too. In addition, the regulations require that an agreement with an external party cover certain matters, and that you monitor its compliance. If the vendor stores information outside Israel, ask your lawyer about the rules for transferring information to databases outside the country.
Transparency and consent. When you collect personal information, the notice must include the purpose, to whom the information will be given, and the controller's identity. The law defines consent as "informed consent." In the draft guideline on AI, the Authority also stresses informing people that they are communicating with an automated system. Update the privacy policy, not only the agent's settings.
Logs. Document what the agent did. At the medium and high security levels, the regulations require a monitoring mechanism and access logging, and keeping the data for at least 12 months. Even in a small business that's the right practice, because without a log you can't investigate an incident.
Deletion and rights. Define who handles requests for access and correction under Sections 13 and 14, where to look for information the agent stored, and how to delete it, including at the vendor.
Incidents. Decide in advance what counts as an incident (unauthorized access, sending to the wrong recipient, a hidden instruction the agent carried out), whom to report to and what to do. The regulations require documenting security incidents. At the medium and high levels there is also immediate reporting to the Authority of a serious incident.

Before connecting an AI agent to customer data

I wrote down which personal data the agent will touch, and marked what's sensitiveHealth, finances, salary, professional confidentiality and more. I passed the agent only what the task needsI checked columns, folders and mailboxes that can be excluded. The agent works in a dedicated account with read-only permission to startAnd the list of valid permissions is written and up to date. I know where the vendor stores the information, and whether it's used for trainingAnd it's written in the agreement or terms of service I read. I updated the collection notice and privacy policy, and the customer knows it's an agentPurpose, to whom the information is passed, and the controller's details. Every action that goes out waits for my approvalA message to a customer, a send, a publication and a record change. There's an action log, and someone sets time to go over itA log nobody opens doesn't help. There's a written procedure for an access or deletion request and for an unusual incidentWho handles it, where to look and whom to report to.

Who must appoint a privacy protection officer, and is it you?

The bottom line: the duty is defined in four categories. A small business that sends quotes and manages customers probably isn't included, but check, because the answer depends on the data and the activity.

Under Section 17B1 of the law, these must appoint a privacy protection officer:

A controller of a database that is a public body, or a holder of such a database (except a security body).
A controller of a database whose main purpose is collecting personal information in order to pass it to others, as a business or for payment, and which holds information on more than 10,000 people.
A controller or holder whose main business includes regular and systematic monitoring of people on a significant scale.
A controller or holder whose main business includes processing information of special sensitivity on a significant scale, including banks, insurers, general hospitals and health funds.

Note two phrases: "main business" and "significant scale." The law spells out what counts as significant scale: the number of people, their share of the population, the scope and types of information, the duration and frequency of processing, the retention period and the geographic area. A business whose whole activity is based on sensitive information, like a large clinic, needs to check itself thoroughly. And a company that provides a service to other bodies may also count as a "holder."

If there is a duty, the officer needs knowledge of privacy law, an understanding of technology and information security, and familiarity with the field of activity. The officer can also be someone who isn't an employee of the body, must not be in a conflict of interest, and reports to the CEO or to an employee who reports directly to the CEO. The duties include monitoring compliance with the law, reviewing the security procedure, and handling inquiries from people.

The Authority published a position paper on appointing an officer, and it also has a page that deals with a policy of non-enforcement of part of the appointment duty. We did not read that page's content in this context, so we don't quote it. Check there for the current status before deciding.

What are the sanctions? Financial penalties, oversight and offenses

The bottom line: the amounts are set by type of violation, with reductions for small businesses. The Authority doesn't have to impose the maximum amount, but it is allowed to.

Under the law's sanctions provisions (Section 23כו in the Hebrew text), the head of the Authority may impose a financial sanction on a controller or holder who violated certain provisions. A few examples from the text:

NIS 150,000 (and double that if the database holds information on a million people or more) for processing information in a database that required registration and wasn't registered.
NIS 15,000 for refusing to let a person inspect information about them.
NIS 50 per person (and NIS 100 for sensitive information, with a minimum of NIS 30,000) for a request for information without the notice required under Section 11.
Separate amounts for violations of the Data Security Regulations, by the database's security level.

The law also defines a "micro business," whose turnover in the previous year did not exceed NIS 4 million, and a "small business," whose turnover is up to NIS 10 million, for the purpose of reduced amounts. The details are in the Fifth Schedule to the law.

Beyond money, the text includes oversight powers: a supervisor may demand documents and information, request a copy of computer material including system data and sample data, and enter a place where there is reason to believe a database exists (for a residence, a court order is required). There are also criminal offenses, for example obstructing a supervisor (six months), misleading the Authority (two years) and processing information from a database without authorization (three years).

A financial sanction against preparing in advance

A financial sanction

The Authority imposes it after a notice of charge and with a right to be heard. You can appeal to a court.

The amount depends on the type of violation
There are reductions for micro and small businesses

What to do

Be able to show what you did before an inquiry arrives.

An information map and a list of permissions
An agreement with the vendor
An action log and an incident procedure

Based on the law's sanctions provisions (Sections 23י, 23כו and 23נג to 23נה in the Hebrew text) and the Fifth Schedule. The amounts are what the Authority may impose, not an automatic fine.

How ready is your business to connect an agent?

Six questions. "Yes" means you're in a better place. The answers stay in your browser only, and this is a thinking tool, not a compliance check.

What we think

The bottom line: Amendment 13 doesn't forbid using AI. It turns "what does the agent see and who approves" into questions you need to be able to answer.

The common mistake we see is thinking the question is "is the tool safe." That's an important question, but it's the second one. The first is "what am I giving it." A trustworthy agent given access to the whole mailbox still exposes the information of everyone who ever wrote to you. We wrote about this at length in the article on Muse and privacy.

The second thing we'd do differently: not start with customer data. You can build an agent that works first on content, on scheduling meetings without customer details, or on internal materials. After a few weeks, once you see how it behaves, expand in small steps.

Here's how we set it up: an agent on a separate cloud server for each business, a dedicated user and minimal permission for each system, the business owner's approval for every sensitive action, and a log for every significant action. This doesn't replace legal advice, and not every business needs a dedicated agent. Platin Digital is an OpenAI Select Partner, and if a simpler solution suits you, we'll say so.

Further reading: an AI agent for business: what it does and how to start, what goes into building an AI agent and what makes up the price of an AI agent.

Frequently asked questions

What is Amendment 13 to the Privacy Protection Law?

Amendment 13 is a comprehensive amendment to Israel's Privacy Protection Law, which took effect on August 14, 2025. According to the Privacy Protection Authority it updates substantive definitions, narrows the duty to register databases, requires certain bodies to appoint a privacy protection officer, and adds financial sanctions and criminal offenses. It wasn't designed for artificial intelligence, but the law applies to any processing of personal information, including processing by an agent. It's Israeli law, so readers elsewhere should check their own local rules.

Does Amendment 13 apply to AI agents and chatbots?

The law applies to processing of personal information by any means. So an agent that reads, stores or sends information about customers falls within the definition. The Authority published a draft guideline on the application of the law to artificial intelligence systems, and we found no confirmation that it was published as a final version. We recommend treating it as a direction, and consulting a professional about your case.

Does a small business have to appoint a privacy protection officer?

Usually not, unless it falls into one of the four categories in Section 17B1: a public body, a data broker with more than 10,000 people, a body whose main business includes systematic monitoring on a significant scale, or a body whose main business is processing sensitive information on a significant scale. Anyone sure they're outside the categories is still subject to the law's other duties, and anyone unsure should check with a lawyer.

Can I upload a customer list to ChatGPT or an AI agent?

There's no single answer, and this isn't legal advice. It depends on the purpose of use, the notice you gave customers, the permissions, the security, and the vendor's terms, including where the information is stored and whether it's used for training. The safer way is to pass only the information the task needs, without sensitive data, and to check the terms first.

What sanctions are there for violating the Privacy Protection Law?

Under the updated text, the head of the Authority may impose financial sanctions set by type of violation, for example NIS 15,000 for refusing to allow inspection, and NIS 150,000 for processing in a database that required registration and wasn't registered. There are reductions for micro and small businesses, plus oversight powers and criminal offenses. The amounts are what the Authority may impose, not an automatic fine.

Do I have to register a database because I connected an AI agent?

The connection alone doesn't create a duty to register. Under Section 8A, the duty applies to a database whose main purpose is collecting personal information to pass it to others as a business or for payment, with more than 10,000 people, and to public bodies. Other databases holding sensitive information on more than 100,000 people must notify the Authority. If you're not sure which category you're in, check with a professional.