Israel’s Privacy Protection Law, Amendment 13: 6 Microsoft 365 settings that expose personal data

What Amendment 13 changed

Enforcement: the Privacy Protection Authority can impose significant administrative fines for breaches of the law and its regulations.
Data protection officer: some organizations must appoint an officer responsible for compliance.
Database registration: the registration duty was narrowed, but a database exempt from registration is still subject to the law and the security regulations.
Data security: the Privacy Protection (Data Security) Regulations of 2017 remain in force. Among other things, they require limiting access to people who need it, logging access (at the intermediate and high security levels) and handling security incidents.

Why this is a Microsoft 365 configuration question

Customer files, payslips, CVs and patient records no longer sit on one server in the server room. They live in mailboxes, SharePoint libraries, employees’ OneDrive and Teams channels. Microsoft 365 settings decide who can open them, share them and send them out. The defaults are built for easy collaboration, not for protecting personal data.

The 6 settings to check first

Setting	The problem	Why it matters for privacy
"Anyone with the link" sharing	Files in SharePoint and OneDrive are shared with a link anyone can open, without signing in	A forwarded link exposes the data to everyone who gets it, and there is no way to know who
External sharing and guests	Vendors, consultants and customers get access, and nobody checks when it should end	Personal data stays reachable by people who no longer need it
Conditional Access	No policy limits sign-in by device, location or risk	One compromised account opens everything that employee can see
Data Loss Prevention	No DLP policy, or one that doesn’t cover Israeli data such as ID numbers	Sensitive data leaves by email or sharing and nobody knows
Audit	Logging isn’t on for every service, or nobody looks at it	After an incident you can’t tell what was exposed and to whom, which makes the reporting duty hard to meet
Retention and deletion	No retention policy, so data is kept forever	The longer personal data is kept, the bigger the damage in a leak

Where to start

Map where personal data lives. Which SharePoint sites, shared mailboxes and Teams channels hold data about customers, employees or patients.
Close anonymous sharing. Restrict "Anyone with the link" for the organization, or at least on sites that hold personal data, and set link expiration.
Review external access. Set up access reviews for guests and remove access nobody uses anymore.
Turn on Conditional Access. Require MFA on every sign-in, and access to company data only from managed devices.
Set up DLP. Microsoft Purview has a ready-made template, Israel Protection of Privacy, that detects Israeli ID numbers and bank account numbers. Start in test mode, see what it catches, and only then block.
Make sure Audit is on. And that someone knows where to look when an incident happens.
Set retention and deletion. Keep personal data only as long as you need it, then delete it.
Prepare an incident plan. Who decides, who investigates, and when you report to the Authority.

How Griffin31 helps

Griffin31 checks the security settings in your Microsoft 365 tenant continuously, including sharing, external access, Conditional Access, Audit, DLP and retention policies, and shows you what to fix first, with the evidence behind the results.

This article explains how the law’s requirements translate into Microsoft 365 settings. It is not legal advice. For questions about your organization’s obligations, ask your data protection officer or legal counsel.

Want to know where your tenant stands? Griffin31 checks your Microsoft 365 security settings continuously and shows you what to fix first.

Book a demo