Israel’s Privacy Protection Authority recently imposed an administrative monetary sanction on the Municipality of Beit Shemesh following a data security incident involving its GIS system. The decision highlights regulatory expectations concerning the documentation and oversight of external service providers with access to personal data, including their identification in database documentation and information security procedures.

In our latest legal update, we examine the broader implications of the decision and raise several practical and legal questions: Must organisations maintain duplicate records of their service providers? How should they reference external providers’ security policies? And does every change to the list of service providers trigger a reporting obligation to the Authority? We also consider how organisations can meet their regulatory obligations without creating unnecessary administrative burdens.

Read the full analysis in Hebrew.