Amendment 13 to Israel's Privacy Law and security cameras: what changed for businesses

Disclaimer: this article provides general information only and is not legal advice. Consult a lawyer or privacy adviser about specific obligations.

Security cameras are almost always a system that collects personal data: figures, faces, licence plates and sometimes audio. That puts them at the heart of privacy law. In the last three years there have been two significant changes in this area: Amendment 13 to the law and the updated guidelines of the Privacy Protection Authority.

Amendment 13 in brief

Amendment 13 to the Protection of Privacy Law was passed by the Knesset in August 2024, published on 14 August 2024 and came into force on 14 August 2025. According to the Authority's explanatory materials, the main changes include:

• A broader definition of "personal information" and of "information of special sensitivity".
• The term database "controller" replaces the previous term and emphasises responsibility.
• The database registration duty is narrowed to certain groups (including public bodies and data brokers holding data on more than 10,000 people), alongside a notification duty for databases with sensitive data on more than 100,000 people.
• A duty to appoint a privacy protection officer in certain categories, including bodies whose main activity involves systematic monitoring at significant scale.
• Expanded enforcement powers, including administrative fines, and damages without proof of harm in civil proceedings in certain circumstances.

The Authority's camera guidelines

The Privacy Protection Authority publishes dedicated guidelines: on surveillance cameras in public spaces (4/2012) and on cameras in the workplace (5/2017). Both were updated in May 2025. Recurring principles include:

• A defined, legitimate purpose for installing cameras, and use of the data only for that purpose.
• Proportionality: location, angle and hours that do not intrude more than necessary. Avoid filming intimate areas such as toilets and changing rooms.
• Transparency: clear signage and notice to employees about camera locations and purpose.
• Limiting retention to what the purpose requires.
• Securing the system and restricting viewing permissions, including logging access.
• Special care with audio recording and biometric means.

What this means for a business or chain

• Map where cameras are installed and what they film.
• Write a camera policy: purpose, retention, permissions, handling requests.
• Ensure signage at entrances and filmed areas.
• Limit the number of people who view recordings and log clip exports.
• Secure the system according to INCD recommendations: no internet exposure, passwords and updates.
• Check whether the organisation must appoint a privacy protection officer.
• When contracting a cloud provider or service contractor, define security and confidentiality obligations in the contract.

The role of technical design

Much of compliance is determined at the design stage: privacy masking in the camera, an angle that does not intrude on neighbours, automatic retention in the recorder, role-based user permissions and an activity log. A professional contractor can implement these settings, but the policy itself is the organisation's responsibility.

Practical examples of proportionality

• A till camera aimed at the payment area, not at the employee's screen or rest area.
• An entrance camera that does not film into neighbours' windows; if unavoidable, mask the area.
• Avoid audio recording without a clear justification.
• A defined retention period with automatic deletion, rather than keeping footage "as long as the disk has room".

Access requests and exports

People may ask to see information about themselves, and enforcement bodies may request clips. Decide in advance who is authorised to handle requests, how exports are logged, and how exported clips are protected (for example an encrypted file or a time-limited link).

Vendors and service contractors

A contractor maintaining the system is sometimes exposed to video. The agreement should include confidentiality, access limited to what maintenance requires, and a remote access procedure. When using cloud services, understand where data is stored and who can access it.

Recommended documents for an organisation

• A written camera policy.
• A map or list of camera locations and purposes.
• Employee notice wording and signage.
• A list of people with viewing and export permissions.
• Records of retention and security settings.

Prepare these with a lawyer or privacy adviser; the contractor can provide the technical information needed.

Questions to ask before adding a camera

• What is the purpose, and is there a less intrusive way to achieve it?
• Who will be filmed: employees, customers, passers-by?
• Does the camera film an area with a heightened expectation of privacy?
• How long must recordings be kept to achieve the purpose?
• Who will view recordings and in what circumstances?
• How will the people filmed know about the camera?

Documenting the answers is a good basis for the camera policy and shows the organisation considered the issue in advance. In some cases, such as large-scale systematic monitoring or biometric use, consider a privacy impact assessment with professional support.

What has not changed

Privacy principles applied to cameras before Amendment 13 too, and the Authority's guidelines have existed for years. What changed is mainly the scope of definitions, explicit responsibility and enforcement powers. An organisation that already followed the guidelines is in a good starting position, and should now check that its documentation and security are up to date.

Summary

Amendment 13 does not prohibit operating cameras; it sharpens responsibility and enforcement powers. A business that plans, documents and secures its camera system is in a better position, both legally and operationally.