Privacy by design: what Article 25 requires, and what Israeli law actually says

“Privacy by design” is used as though it were a universal legal duty. It is a duty in Europe, with a specific article behind it. In Israel it is not — and the gap between those two facts is where Israeli companies tend to get bad advice, in both directions.

What Article 25 actually requires

GDPR Article 25 has two halves that are often collapsed into one. By design is the obligation to build data protection into a system at the point it is designed — not to add controls to it afterwards. By default is stricter and less discussed: absent any choice by the user, the system must process only what is necessary for each specific purpose. That covers how much data is collected, how long it is kept, how widely it is accessible, and whether it is exposed to an indefinite number of people without intervention. A system that offers good privacy settings but ships with them switched off satisfies the first half and fails the second.

Israeli law has no Article 25

There is no provision in the Protection of Privacy Law, and none introduced by Amendment 13, that imposes a design-phase privacy duty comparable to Article 25. Anyone citing Israeli law for a general privacy-by-design obligation is describing the direction of travel rather than the text. This matters practically: an Israeli company with no European exposure cannot be told it is breaching a by-design duty, because the duty is not there to breach.

What Israeli law has instead

Three narrower routes cover much of the same ground, and all three are enforceable in a way the slogan is not.

Purpose limitation and minimisation. A database may hold only information necessary for the purpose it was established for. That is the substance of Article 25’s “by default” half, and it applies at collection rather than at design review.

The Data Security Regulations 2017. These impose risk-based obligations scaled to a database’s tier — basic, medium, or high. The database definitions document, the risk assessment, and the periodic review are design-phase artefacts in everything but name: they require you to characterise a system’s data and risks in advance, and to revisit that characterisation as the system changes.

The regulator’s AI guidance. The Privacy Protection Authority issued draft guidance on 30 April 2025 applying the Privacy Protection Law across the AI lifecycle. It expects a privacy impact assessment before an AI system is deployed, a designated officer for AI matters, an internal policy governing what staff may put into generative AI tools, and restrictions on scraping. A December 2025 guide on privacy-enhancing technologies sits alongside it.

The status of the AI guidance is the part to watch

That guidance is not final. Consultation closed in June 2025 and finalisation is expected during 2026, with enforcement to follow. Two things follow from that, and they point in opposite directions.

It is not currently a binding rule, so anyone selling you compliance with it today is selling you something that does not exist yet. But it is a published statement of how the regulator intends to read an existing law, which is a reasonable basis for a decision you are making now — and the practices it describes are the ones that take longest to retrofit. A generative-AI usage policy is a week of work before staff have habits, and considerably more afterwards.

What this means in practice

You will be assessed on the substance regardless of which regime names it. The defensible position for an Israeli company is not “we comply with privacy by design” — there is nothing to comply with — but that design decisions about personal data are made deliberately, at the point they are made, and leave a record.

In practice that is a small number of moments: before a new tool or vendor receives personal data, before data moves to or is accessed from another country, before a new category of data is collected, and before a system starts making decisions about people without a human in the loop. Each of those is cheap to handle in advance and expensive to unwind. That asymmetry, rather than any particular article, is the real argument.