Frequently asked questions about Amendment 13

Amendment 13 updated the Privacy Protection Law, 1981, and widened the enforcement powers of the Israeli Privacy Protection Authority. The main duties: appointing a data protection officer (DPO) in public bodies and in organisations that process sensitive information at scale or carry out systematic monitoring; wider notice duties towards the person whose data is collected; a sharp reduction in database registration, alongside a duty to notify the Authority about large and sensitive databases; and an explicit ban on processing data that was collected unlawfully. As for data already sitting in your systems, the law forbids processing personal data in a database for anything other than the purpose lawfully set for it, and the Authority turns that into a practical instruction: Amendment 13 encourages businesses to keep only the information they need, and to delete the rest. (Our translation; the Authority publishes in Hebrew.)

No. Every deletion in Microsoft 365 goes through the approval path only: a ledger line is written for the item, its status moves to pending deletion, and only then is the task dispatched. No scheduled job deletes anything in Microsoft 365. Once a day a pass looks for an approved deletion with no confirmation that it ran, writes a ledger line about it, and never re-runs it.

Three things. First, Microsoft 365 itself: Graph calls, sign-in, and reading legal holds through Exchange Online PowerShell. Second, a licence validation request, twice a day, carrying three fields only: the licence key, a random installation identifier and your Microsoft 365 tenant ID; activating a free licence also sends, once, the contact details from the registration form: name, email, company and phone. Third, outgoing mail, through your own mail server: alerts, and a request to a mailbox owner carrying the file name and the reason. There is no telemetry and no error reporting. The licence response also carries the latest version number, which is how the system tells you an update is out, with no separate call outwards, and without downloading or installing anything by itself. If the licence server is unreachable, the system keeps working for 72 hours.

The Knesset passed it on 5 August 2024, and it entered into force on 14 August 2025. On that same day the Privacy Protection Authority published a dedicated preparation page and updated its guidance to match the new text.

The amendment gives the Privacy Protection Authority the power to impose financial sanctions, alongside wider investigation and supervision powers. The head of the Authority, Adv. Gilad Semama, said the day before it came into force that enforcement would follow an orderly programme: some breaches would be fined only after a two-stage mechanism that gives the organisation time to understand the requirement, and others would be fined with no prior warning. None of this is legal advice; the sources are listed at the bottom of this page.

No. The system finds personal data whose purpose has ended and documents who decided to delete it and when. It does not handle data subject access requests (DSARs), does not report to the authority, does not appoint an officer, does not keep a database register and does not replace legal advice.

In four steps, and this holds for any tool, not only ours. First, data mapping: which mailboxes and which SharePoint sites hold personal data, and what purpose was lawfully set for each database. Second, data discovery: a scan that reads content, finding Israeli ID numbers, payment card details and personal documents, not only file names. Third, the decision: for each finding, whether the need for it has ended and who approves the deletion. Deleting automatically, with nobody approving, is an operational risk rather than compliance. Fourth, the record: a deletion with no ledger entry proves nothing to an auditor. In Microsoft 365 the deletion itself runs through Graph and through Exchange Online and has rules of its own: a legal hold stops it, and earlier SharePoint versions are deleted separately from the file.

Exchange Online mailboxes and SharePoint sites. There is no code touching Teams, local file servers or third-party systems.

Content. Scanned PDFs and images go through OCR and are read like documents. In SharePoint you set a maximum file size per policy, defaulting to 50 MB. A file over the limit is not skipped silently: it is raised for manual review, marked as too large to scan.

Yes, on the Live Context Review screen. It opens from the pending approvals screen and from the scan results, and loading the file content pulls it from Microsoft 365 at that moment. A PDF opens page by page, an image is shown in full, a text file is shown as text, and a ZIP archive opens as a file tree. Word documents and Excel sheets that live in SharePoint open in the Microsoft preview inside the screen, and your browser loads them straight from Microsoft 365, without passing through the server. A file of any other type that arrived as a mail attachment is shown by name and size only. The file is never written to disk on the server, and the match itself is not highlighted inside the document.

It is not skipped silently. It lands in the manual review list with its reason: password protected, encrypted archive, corrupt file, unsupported format, too large to scan, partial scan or a failed download. From there you select rows and send them for user review: an email goes out from your own mail server to the owner of the mailbox holding the file, carrying the date, the file name and the reason (not the file itself and not a link to it), and three questions: is there personal data in the file, is there a business need to keep it, and may it be deleted. The employee replies by mail and whoever handles the finding records that answer in the product; it does not decide the finding; it is kept alongside the decision. If no answer comes back you can send up to three reminders and then escalate, and you can also decide without one. The request, the reminders and the answer are all written to the ledger. The request exists for files that arrived by mail; a file in SharePoint has no owner recorded in the system.

An Israeli ID number is validated against its check digit and a credit card with Luhn, not by pattern alone. The context is then checked in a 150-character window around the number.

Each template carries the source behind it: ten cite Israeli law, one cites the GDPR, and one, the global pattern set, states that it is organisational policy rather than a legal obligation. Three carry a built-in seven-year retention period: medical, financial and payroll records.

On your server. The deployment is on-premises: the database and the processes run in containers on your organisation's own server, and scan results, the ledger and the policy never leave it. In information security terms, the personal data that gets scanned is never copied to a cloud of ours and never reaches a third party.

Finding metadata: file name, size, location in Microsoft 365, which policy matched it, who decided and when. The file name and its location are kept in full for as long as the finding is awaiting a decision; the moment the decision is made the location is deleted and only a masked fragment of the name remains, for example contract_***.pdf. The audit ledger has no name column. In its place it records a signature that cannot be turned back into a name: the first two characters, a hash, and the extension. The address of a scanned mailbox is kept in the mailbox list for as long as it is set to be scanned, because it is what identifies the mailbox; a sender address inside a mail finding is deleted with the decision. The file itself is read in memory and never written to disk, and an Office document in SharePoint opens in your browser straight from Microsoft 365 without passing through the server at all. A short excerpt of the content is kept as evidence until the decision: it is deleted the moment the decision is made, and in any case within 30 days; a daily job purges any evidence past that date. An answer the file owner sent and you recorded in the product is kept alongside the decision and is not deleted automatically.

An item not under hold: in mail, a permanent deletion the mailbox owner cannot restore. In SharePoint, every previous version is deleted and the file itself goes to the site recycle bin. RTBFIL detects Litigation Hold in supported sources. The handling of items and deletion decisions is subject to the organisation’s retention policies, Litigation Hold configuration, permissions, and Microsoft 365 settings. The system never empties the site recycle bin.

The ledger is a hash chain: each line signs the one before it, so changing a single line means recomputing every line after it. The integrity check button walks the chain and verifies that every line carries a hash, that each link to the previous line holds, and that recomputing gives the same value. The CSV export goes to legal counsel, the privacy officer or the auditor, carrying the log id, action, service, actor, finding, file or message, policy, timestamp and details.

It stays with you. Removing the containers does not delete the database or the ledger: they sit in Docker volumes that remain on the server until you delete them yourself.

Three application-level Graph permissions, with a one-time admin consent: Mail.ReadWrite, Sites.ReadWrite.All and User.Read.All. Until an approved deletion the system only reads, and makes no write calls to Microsoft 365. To have it detect legal holds, you also grant a read role in Exchange Online.

Windows 10/11 64-bit on a Pro, Enterprise or Education edition with Docker Desktop, or a Linux server with Docker Engine. Windows Server is not supported: Docker Desktop does not run on server editions of Windows. You need Compose v2, 4 cores, 8 GB of RAM, 100 GB of SSD and a free port 80. The firewall needs outbound access on port 443 to three destinations: Microsoft sign-in, Microsoft Graph and our licence server. The installation package is delivered directly by us, with a sha256 fingerprint to verify before installing.

Both, with identical coverage. English is the default, and you switch language in the interface.