Many ventures postpone legal matters until "there are customers and revenue," relying in the meantime on a privacy policy and terms of use copied from another website or generated by an AI tool. But exposure does not wait for revenue. It can begin with the very first piece of user data collected.
Amendment 13 to Israel's Privacy Protection Law significantly expanded enforcement powers and introduced new obligations. A document that looks professional is no evidence that anyone has examined the product, the data flows or the obligations that apply to the venture.
A Privacy Policy Is Not a Template
A privacy policy tells users how the venture collects and uses their data. It must be derived from an examination of the actual operation: what data is collected and why, who has access to it, how it moves between systems, vendors and AI tools, in which countries it is processed and what role each party in the chain plays.
The question is not only how the document is worded, but what was examined before it was written. Generic wording may promise things the product does not deliver, omit material uses or describe security measures that do not exist.
A privacy policy does not legitimize a prohibited use of data. A document that does not reflect the actual operation can turn from a statement of transparency into evidence of the gap between what users were promised and what actually happens.
Exempt From Registration Is Not Exempt From the Law
Narrowing the duty to register databases does not remove the substantive obligations that apply to them. Depending on the nature of the activity, these include a database definition document, notice to individuals when data is collected, classification of the security level and implementation of the resulting requirements, regulation of vendor relationships and review of data transfers outside Israel.
The duty to report a severe security incident is also not something to look into only after a breach. You need to know in advance which incidents require reporting, who handles them and how a timely decision is made.
Some ventures must also appoint a Data Protection Officer, an Information Security Officer, or both. These are different roles, and the duty to appoint depends on statutory conditions, including the nature and scale of the activity. Even a venture that processes data on behalf of business customers may be required to appoint one: being "just a vendor" does not in itself exempt it.
"Sensitive Data" Is Broader Than You Think
Personal data is not only a name and an ID number. An online identifier or location data may also be personal data, if it allows a person to be identified with reasonable effort, directly or indirectly.
"Data of special sensitivity" is not limited to medical information. The definition includes, among other things, salary and financial activity data and certain types of personality assessments and location data. So a venture in recruitment, fitness or financial services may well be processing it. What counts is the data collected and processed, not the business label of the product.
Two more points that are easy to miss: encryption alone does not make data anonymous, and an insight an AI system infers about an identified or identifiable person may itself be personal data.
Targeting Europe? The GDPR May Apply Too
A venture with no presence in the EU may still be subject to the GDPR if it offers goods or services to people in the EU or monitors their behavior there. The mere fact that the website can be accessed from Europe is not enough on its own.
In dealings with enterprise customers, privacy and security requirements can also become commercial conditions: a data processing agreement, sub-processor terms, international transfers and incident handling commitments.
Gaps in how data processing is governed can delay a deal or prevent it entirely, even when the product itself is ready.
Enforcement Is Already Here
On July 21, 2026, Israel's Privacy Protection Authority announced a monetary sanction of ILS 256,000 against Meuhedet, one of Israel's health maintenance organizations, for failing to promptly report a severe security incident. The case shows that exposure also relates to how an incident is handled and when it is reported.
Amendment 13 allows significant monetary sanctions, the amount depending on the type of violation and the characteristics of the database and the violator. For example, processing data without authorization or for an unlawful purpose may result in a sanction of at least ILS 200,000 at the base amount, and courts may award up to ILS 10,000 in damages without proof of harm for certain violations. In cases defined by law, invasion of privacy is also a criminal offense carrying up to five years' imprisonment. Reduction mechanisms and caps exist for small businesses, but they apply to the monetary sanction only.
In circumstances set out in the law, the Authority may also apply to the court to halt data processing and even to delete data from a database. For a venture whose operation depends on data, restricting its use can hit the product itself.
Why "Later" Costs More
The most significant decisions are made early: what data is kept, for how long, who may access it and which vendors receive it.
A venture that built its product without addressing these questions may discover, during an investor's due diligence or an enterprise customer's procurement process, that the fix requires changes to the product, to vendor agreements and to internal processes, not just an update to the privacy policy.
Early guidance makes it possible to tailor compliance to the activity and the venture's stage, and to reduce the need for costly fixes later.
How We Can Help
- Legal review of privacy and information security requirements: mapping the activity, classifying the venture's role and identifying the obligations that apply, in coordination with the technology team.
- Privacy policy and terms of use derived from the product and the business model.
- Data processing agreements and vendor and customer contracts that define permitted uses, obligations and allocation of responsibility.
- Ongoing advice as the product, vendors and target markets change.
Before going live, make sure the product, the agreements and your statements to users are aligned, and that you understand what you are responsible for.
This article does not constitute legal advice and is not a substitute for a specific review of your activity.
Natan Mordechai, Adv.
Admitted to the Israeli Bar in 2020, Natan holds a degree in Business Administration with a specialization in Accounting. His practice focuses on transactions, mergers and acquisitions, commercial agreements, technology law and privacy. Before founding the firm, he worked as an investment analyst covering private-market investments at an institutional investor, bringing both legal and financial perspectives to his transactional work.
All articles →