תיקון 13 לחוק הגנת הפרטיות - ייעוץ וליווי

Amendment 13 readiness is not a privacy-policy rewrite. Organizations need to understand what personal information they hold, why they use it, who receives it, how long they keep it, and how it is protected.

Art of Cyber supports companies with practical Amendment 13 readiness: data and process mapping, applicability of the law's duties, gap documentation, a remediation plan and controls that keep working after the project ends. The work is done with leadership, IT, security, operations and legal. The service does not replace legal advice; it turns legal requirements into an organizational and technical work plan.

What did Amendment 13 change?

The amendment widened the Privacy Protection Authority's enforcement powers, updated definitions and duties, and sharpened the responsibility of organizations processing personal data. Some organizations must also appoint a data protection officer, depending on the type of activity and the scale of processing. Not every organization carries the same duties. The first step is not buying a template. It is checking what applies to your specific activity.

Who is it for?

• Companies collecting data on customers, employees, candidates or users
• SaaS, fintech, medtech, health and companies with significant data repositories
• Organizations transferring data to cloud vendors or providers outside Israel
• Companies that must answer customers on privacy and security
• Leadership teams that want to know what is missing before an audit, a deal or an incident
• Organizations checking whether they must appoint a DPO or need DPO as a Service

What does the work include?

Scope is tailored to the organization and can include:

• Mapping data repositories, data types and processing activities
• Mapping purposes, data sources and transfers to third parties
• Checking registration, notification and documentation duties
• Checking whether a data protection officer must be appointed
• Reviewing privacy notices, forms and consent processes
• A process for data-subject access and correction requests
• Vendor, contract and data-access mapping
• Reviewing data transfers outside Israel
• Retention, minimization and deletion policy
• A security gap review and risk-based controls
• A remediation plan with priorities, owners and timelines
• Management and employee training as needed

Where legal interpretation is required, we work alongside the organization's legal counsel. Art of Cyber owns the practical side: systems, processes, vendors, controls, evidence and tracking.

How does the process look?

1. Set the scope

We understand which activities, systems and group companies are inside the review.

2. Map data and processes

Not a system list. We check what comes in, why, who uses it, who receives it and how long it is kept.

3. Identify duties and gaps

We separate legal gaps, process gaps and technical gaps. Each gap gets a severity, an owner and a closing path.

4. Remediate and document

Update forms and policies, close permissions, regulate vendors and build processes that can actually run.

5. Move to ongoing management

Privacy is not a one-time document. Changes in products, vendors, AI and marketing require re-checks.

Possible deliverables

• A data and repository map
• A list of duties that apply to the organization
• A gap report and remediation plan
• Updated privacy policy and collection notices, coordinated with counsel
• A data-subject rights procedure
• A retention and deletion procedure
• A vendor and data-transfer register
• Security requirements and a control plan
• A management reporting pack

How much does Amendment 13 support cost?

Price depends on the number of systems and entities, data types, vendor count, transfer complexity and current state. Three models are available: a focused gap assessment with a report and remediation plan; a full readiness project from mapping to implementation; or ongoing support and DPO as a Service after the initial gaps close. After a short scoping call we can define scope and give a fixed project price or a clear monthly frame.

Bottom line

The goal is not to declare "everything is compliant" after one meeting. The goal is to know which duties apply, what the actual risk is, what to fix first, and how to prove the organization manages privacy continuously.

Book a scoping call and we will come back with a precise proposal.