Board of Director’s Responsibility for Data Security in a Company

The Israeli Privacy Protection Authority recently published a binding directive addressing the board of directors’ responsibilities for fulfilling of a company’s obligations under the Privacy Protection Regulations (Data Security). This directive, which has now come into effect following public comments, expands and clarifies the responsibilities imposed on a board of directors with regard to privacy protection and data security.

The directive states for the first time that the board of directors bears full responsibility for data security in a company and that, in the event of a violation of the binding rules, the company will be exposed to a fine of ILS 320 thousand per violation.

Applicability of the Directive

This latest Privacy Protection Authority directive focuses on corporations primarily engaged in processing personal information or whose business activities could give rise to heightened privacy risks. Examples include:

Cellular companies and companies that collect location data
Banking corporations and insurance companies
Companies operating in the medical field
Major retailers
Manpower companies and screening institutes conducting personal evaluations

To determine whether the directive’s provisions apply to a corporation, one must analyze, among other factors, the corporation’s characteristics (including whether it is private or public), the type and sensitivity of the information being processed, the volume of information being collected, and the number of employees authorized to access it. For example, corporations that collect a significant volume of economic or medical information during their routine operations will be subject to the directive.

Board of Directors’ Responsibility for Implementing the Regulations

According to the Authority’s directive, as one of the company’s organs responsible for data security, the board of directors is responsible for overseeing and ensuring the company’s compliance with the law and regulations and for setting an organizational policy in this regard. The board is also required to be directly involved in fulfilling these requirements, including participating in decision-making.

Accordingly, the directive states that the board of directors is responsible for fulfilling five key obligations under the regulations:

Approve a database definition document, which must include a description of the activities of collecting and using the information, a description of the purposes for using the information, and the various types of information included in the database.
Disucss the key principles of the organizational data security procedure. This procedure must include instructions regarding the physical and environmental security of the database, database access authorizations, a description of the measures required to protect the database, and how to respond to data security incidents.
Hold a quarterly or annual discussion (depending on the security level of the database) of data security incidents in the corporation, including whether the organizational data security procedure needs to be revised.
Oversee a discussion of the results of a risk review and penetration tests and approve the actions required to rectify any deficiencies identified (for databases requiring a high level of security).
Discuss the results of the periodic audit concerning compliance with the regulations (conducted once every two years for medium- and high-security databases).

Other Key Provisions

The directive also refers to Amendment 13 to the Privacy Protection Law, which was recently approved by the Knesset and is expected to come into effect in August 2025. The amendment defines a new category of “highly sensitive information,” which affects the amount of financial sanctions imposed in the event of a violation. It also requires companies to appoint a privacy protection officer, register databases, and report their existence to the Privacy Protection Authority.
The directive recognizes that, in appropriate circumstances, the board of directors may delegate its responsibilities to another entity within the company, taking into account the degree of privacy risk involved in the company’s activities, its size, and the composition of the board. Even in such cases, however, the board of directors remains obligated to actually oversee compliance with the regulatory requirements.
The directive clarifies that the board of directors’ obligations supplement and do not diminish the responsibilities imposed on the company’s management, its CEO, or any other officer responsible for regulatory compliance. Furthermore, the directive could form the basis for derivative suits filed by shareholders against directors.
Finally, the directive states that one of the key ways the board of directors may fulfill its supervisory obligation is by adopting an effective internal enforcement program. Such a program should include mechanisms for monitoring, reporting on, and overseeing the implementation of the laws and regulations governing privacy protection and data security.

Proposed Measures

To mitigate the risk of personal liability for directors in connection with their obligations under the regulations, whether in enforcement proceedings by the Privacy Protection Authority or in personal or derivative lawsuits, a company and its board of directors should familiarize themselves with their obligations under privacy protection laws. Directors must also take steps to fulfill those obligations in practice.

To fulfill the applicable data security obligations outlined above, companies should consider implementing the following measures:

Provide training sessions for board members on privacy protection and data security.
Remap the databases in their possession to classify them in accordance with the Privacy Protection Regulations (Data Security).
Update the assessment of the data security risks that the company faces.
Review and update the company’s data security procedures relating to security incidents.
Ensure that the company’s internal control systems comply with the revised provisions.
Consider appointing a professional advisor to the board on privacy protection and data security matters.

***

Barnea Jaffa Lande’s Privacy, Cyber and AI Department is available to answer questions about privacy protection, data security, and building compliance programs.

Dr. Avishay Klein is a partner and head of the firm’s Privacy, Cyber and AI Department.

Adv. Masha Yudashkin is an associate in the firm’s Privacy, Cyber and AI Department.