What Israeli Startups Need to Know About EU GDPR Requirements
Maintaining GDPR compliance is important for organizations to avoid violating EU privacy laws and facing large fines. But does GDPR law only apply to European organizations, or are there cases when Israeli startups need to comply with GDPR requirements?
This post will answer these questions and more.
GDPR Compliance Requirements: Do They Apply to Israel?
GDPR stands for General Data Protection Regulation, an EU legislative act sought to shape personal data protection requirements for organizations. Organizations operating within the European Union or processing personal data records of EU citizens are subject to GDPR requirements. Israeli startups planning to operate in the EU must maintain GDPR compliance.
8 key takeaways from GDPR requirements
Eight key positions in the General Data Protection Regulation Act define individual rights regarding their data.those are the rights
- access. According to the GDPR, organizations must give their customers access to their personal data as soon as they request it.
- forget it. If a customer wishes to stop using the organization’s products or services and plans to cease being a customer, such customer may request that personal data be deleted.
- Data portability. Customers may request that their personal data be transferred to another organization.
- be informed. Customers must be notified of the collection of their personal data before the collection takes place.
- Please correct the information. You have the right to ask your organization to update your personal data if the data is outdated, incorrect or incomplete.
- restrict processing. Organizations may retain data in storage without use if the customer has notified them of the restriction of personal data processing.
- object. Customers may restrict the use of personal data for direct promotional and marketing purposes.
- You will be notified. If your organization suffers a data breach that compromises personal data, you must notify your customers within 72 hours of discovering the breach.
Impact of GDPR requirements on Israeli organizations
The General Data Protection Regulation (GDPR) law has had a major impact on Israel’s regulatory realities. This impact can be summarized in five direct and indirect points:
- Any Israeli organization conducting business in the European Union or providing services remotely to EU residents is within the scope of this law.
- If international investments fund Israeli startups, the GDPR will likely affect their data protection approach.
- If your startup intends to process personal data from EU-based data collectors and owners, contractual requirements require your organization to apply GDPR standards.
- According to the European Commission, Israel has adequate regulations standardizing the processing, storage and transmission of personal data. This means the Israeli organization can easily exchange data with her EU contractors. However, this perception has been publicly debated in view of general improvements and changes in European Union regulations. If EU officials reconsider this approval, it could be withdrawn if the EU determines that Israeli legislation has not sufficiently kept up with the reality of her new EU legislation.
- GDPR is the result of a thorough update to build a modern data protection policy. The EU initiative has had some impact on Israel’s legislative review. For example, the GDPR indirectly impacted Israel’s Privacy Protection (Data Security) Regulation in 2017.
GDPR and Israeli Privacy Law: Data Transfer Rules and Differences
According to the GDPR, when an organization initiates a data transfer, it must first ensure that the transfer meets general requirements. The second step is to check whether the transfer of that data to a third country is permitted. GDPR regulations require a distinction between safe and unsafe third countries, subject to European Commission adequacy decisions.
According to this law, third countries that guarantee an adequate level of protection are Andorra, Argentina, Canada (commercial organizations only), Faroe Islands, Guernsey, Israel, Isle of Man, Jersey, New Zealand, Switzerland, Uruguay, Japan, UK, South Korea. Data transfers to these countries are expressly permitted. ”
Key differences between Israeli data protection requirements and GDPR
The short list of features below will help Israeli startup owners and investors better understand the two legislative environments.
data security
GDPR requirements force data controllers and processors to embrace specific organizational and technical approaches that ensure security correlates with risk levels. Israeli regulations, on the other hand, form specified and detailed requirements regarding personal data that is collected and stored in an organization’s database.
Data Protection (Security) Officer
The GDPR requires organizations that control and process data to engage a Data Protection Officer (DPO) where defined. Israel’s privacy law also includes a requirement to appoint a data security officer with similar responsibilities as the DPO.
outsourcing
The GDPR allows outsourcing of data processing from controllers to processors. Processors are then obliged to sign specific written agreements to comply with specific instructions and requirements when processing data on behalf of the controller. Compliance with Israeli law is only possible after both parties add certain definitions and terms to their data processing outsourcing agreement.
Database registration
Database registration is not mandatory under GDPR. Israel’s privacy laws require certain databases to be registered with the Database Registrar. The organization must then notify the registrar of any data export or other action.
Data export limits
With respect to certain exceptions, the General Data Protection Regulation Act permits the transfer of data records to recipients recognized by the European Commission as having an appropriate data protection policy level. Israeli law requires explicit consent from the data subject for its transfer and appropriate agreements between the sender and recipient of the data.
Conclusion
Maintaining GDPR compliance is mandatory for Israeli start-ups operating in the EU market, or for storing or processing personal data of EU residents. According to the European Commission’s decision, Israel’s privacy law regulations provide adequate protection for personal data. Due to differences in the legislative acts of the two regions, additional adjustments and signatures may be required to avoid legal issues in some cases.
Written by Alex Tray, a cybersecurity consultant.
