Mongolia

The Law on Protection of Personal Information, article 3.1, defines who is covered by activity, not by territory and not by who you target. It covers what happens when a person, a company or an organisation without legal personality collects, handles, uses and secures personal data. Article 3.2 extends the same rules to work done with technical means and software. There is no equivalent of the European test of 'offering goods or services to people in the territory'. There is no registration duty and no representative duty anywhere in the Act. The real reach comes from three other places. Order A/90 of 2023 requires the server that handles sensitive data to be in Mongolia, which is a physical hook. The Law on Public Information Transparency binds anyone carrying out a state function under a law or a contract. And the Law on Telecommunications, article 19-1, treats data storage infrastructure and content delivery networks as licensed 'information network' activity. So building a point of presence in Mongolia needs a licence from the Communications Regulatory Commission.

Three layers stack up. (1) The national base rule. Article 14.1 of the Law on Protection of Personal Information is a ban with two ways out: a legal or treaty basis, or the person's consent. Consent must be written, on paper or electronically. It must be verified electronically or against an identity document. It must list every recipient (articles 8.2.6, 8.3, 8.4, 8.11). (2) The data-type wall. Order A/90 of the Minister of Digital Development and Communications is dated 11 September 2023. Its clause 3.2 applies to every organisation handling sensitive, genetic or biometric data. The server must be in Mongolia and reachable only from Mongolia. It must sit in a purpose-built technical room. It must be able to exchange data through the state 'KHUR' exchange. It must be synchronised to the Communications Regulatory Commission's time server, protected by a certificate and backed up regularly. Article 4.1.12 of the Act treats correspondence data as sensitive. That means letters, parcels, e-mail and anything exchanged over telecommunications and information technology. So on its face A/90 reaches unusually far. (3) The public-sector wall. The rule is in Law on Public Information Transparency articles 18.12 and 27.7. The core state exchange system, and every foundational and sector-specific public database, must be located in Mongolia. Article 33.2 requires them to be held at the National Data Centre. Foundational databases include the civil registration databases and the geodesy and cartography database (article 27.3). We found no storage-location rule of their own for banking and payments, insurance and securities, telecommunications, education or online gaming. For those, the national base rule and A/90 still apply.

There is no approved-country list. There are no standard contract clauses, no company-wide rules, no certification route and no case-by-case government permission. That is true for every transfer under the Law on Protection of Personal Information. The only routes are the legal or treaty basis in article 14.1, and consent. Consent must be given in writing, on paper or electronically (article 8.3). An electronic consent is valid only if the person was identified and checked by a means set by law, or one they accepted (article 8.4). Silence or the passing of time is expressly not consent (article 8.6). You must be able to prove consent (article 8.9). You need consent again for any new purpose (article 8.10). And you need separate consent to pass data on, unless your original notice already listed the recipients (articles 8.2.6 and 8.11). Consent can be withdrawn at any time, and you must make withdrawal easy (articles 8.7 and 18.4). Note the mismatch. For sensitive data, consent gets you past article 14 but not past order A/90. That order fixes where the server may sit, whatever anyone agreed.

The Law on Protection of Personal Information, article 24, gives the National Human Rights Commission the supervisory role. It monitors compliance. It receives and investigates complaints, and can act on its own initiative. It issues demands and recommendations. It receives companies' annual incident registers every January. It reviews impact assessments. And it reports on data protection in its annual report on the state of human rights. Article 24.2 requires one named Commission member to hold this portfolio. Article 25 gives the Ministry of Digital Development, Innovation and Communications the rule-making role in the digital world. It approves technology security requirements for sensitive, genetic and biometric data. It receives and registers reports of security failures and cyber attacks. Article 26 leaves every other state body to supervise within its own remit. Fines are not in the privacy law at all. They sit in the Law on Infringements, article 6.27, and are applied by inspectors, the police and the courts. The visible evidence of activity is on the ministry's side: order A/90 in 2023, the joint risk assessment methodology A/30 and A/148 in 2024, and a register of 49 companies allowed to carry out information security audits, with permissions running from 2026 to 2029. The National Human Rights Commission is a long-standing, staffed national human rights body. But its website is a JavaScript application whose content we could not read, and we found no published data protection decision.

The maximum side is article 15 of the Law on Protection of Personal Information. You delete at the person's request where you collected or used the data unlawfully. You delete where a law, a treaty or a final court judgment orders it. And you delete where the original purpose has been achieved, or the contract or agreement says so. Article 15.2 then forbids deletion on any other ground, unless another law allows it. That turns the usual 'delete when you no longer need it' instinct on its head. It makes routine clear-outs legally risky without a written ground. The minimum side is scattered. Law on the National Payment System, article 30.1: operators, participants and payment service providers must keep documents from payment system activity for at least 15 years from receipt or creation. Order A/90 clause 3.1.6: keep a historical register of every change, deletion and restoration of sensitive data. Law on Cyber Security articles 17.1.3 and 19.2.9: keep information system activity logs for the period set in the general cyber security procedure approved by the Government. We could not confirm that period. One oddity worth knowing. Article 13.2 of the privacy law allows sensitive data about a dead person to be used without consent once 70 years have passed since death.

DEADLINE ONE, to the person. The duty is in article 22.2 of the Law on Protection of Personal Information. Tell the person immediately where a breach may harm their rights or lawful interests. Article 22.3 sets out what the notice must say: who and what was affected, your name and contact details, the possible consequences, and the steps you took to fix it. A supplier who spots the breach must tell you immediately (article 22.1). DEADLINE TWO, to the ministry. Article 25.1.3 makes the ministry receive and register reports of security failures and cyber attacks on information systems used for personal data. The ministry must act immediately. DEADLINE THREE, to the cyber response centres. Law on Cyber Security article 17.1.2 covers information technology service providers. They must report a cyber attack to the relevant response centre immediately. If they cannot stop it, they must ask for help. Article 17.1.9 makes them tell affected users immediately. Article 19.2.14 makes critical information infrastructure organisations report immediately once normal operation is lost. Article 4.1.3 of the privacy law defines 'immediately' as the shortest possible period. So there is no set number of hours to plan against. The annual filing is article 22.6. The register of breaches and your responses goes to the National Human Rights Commission every January, and on demand at any time. There are two centres to choose between. The National Centre sits inside the intelligence agency and covers state-owned critical infrastructure and bodies on the unified state network. The Public Centre sits under the ministry and covers everyone else.

(1) Article 10.1 of the Law on Protection of Personal Information covers fingerprints and genetic data. Only five named state bodies may collect them, and only for five named purposes. Article 10.2 lets an employer use biometric data other than fingerprints, with the employee's consent, to make identity checks easier under its internal labour rules. Article 10.3 then forbids the employer from changing that data or passing it to anyone else. That rules out an offshore biometric access control supplier. Article 31.1 required fingerprints collected before the law started to be destroyed. (2) Article 4.1.12 lists correspondence among sensitive data. Article 4.1.4 defines correspondence data as letters, parcels, e-mail and anything exchanged using telecommunications or information technology. Read literally with clause 3.2 of order A/90, that puts an ordinary hosted mailbox under a server-in-Mongolia duty. We found no guidance narrowing this and no enforcement testing it. (3) Property, education, membership and digital identifiers are ordinary personal data under article 4.1.11. Health, correspondence, genetic and biometric data, digital signature private keys, criminal record, sexual orientation, gender identity and sexual life are sensitive under article 4.1.12. Money is not on the sensitive list. Biometric log-in is. (4) Article 30.2 says people and companies that break the law are liable under the Criminal Code or the Law on Infringements. The Law on Infringements article 6.27 covers unlawfully getting, handling, transferring or disclosing sensitive data. It costs a person 2 million tugrik, about 600 US dollars. It costs a company 20 million tugrik, about 5,700 US dollars. Using data outside the original purpose costs a person 500,000 tugrik (about 140 US dollars) and a company 5 million tugrik (about 1,400 US dollars). (5) Article 19-1 of the Law on Telecommunications covers four things. They are internet protocol interconnection, data storage infrastructure, content delivery networks, and virtual networks between demarcation points. All count as licensed information network activity. So a local point of presence needs a licence from the Communications Regulatory Commission. A sixth, for critical infrastructure. If a foreign national or foreign company carries out your cyber risk assessment, you must first get the opinion of the intelligence agency.

Featured on the ministry's own home page on 18 August 2026: 'Give your feedback on the draft primary Data Law'. It cites minute 18 of the Government meeting of 13 May 2026. At that meeting the Government ordered steps to create the legal conditions for putting data into economic circulation and reuse. It also ordered preparations for an energy-efficient green data centre in Mongolia. No text, no bill number and no consultation deadline appeared on the page we read, and the linked detail page returned an error. Powers already in someone's hand, fastest first. (1) Article 20.2 of the Law on Protection of Personal Information lets the ministry act by order alone. It can set the security requirements, the assessment methodology and the requirements for storage technology. That is exactly the power used to create the server-in-Mongolia rule in 2023, and it can be widened the same way. (2) Article 25.1.2 lets the ministry approve technology security requirements for sensitive, genetic and biometric data. (3) Article 27.9 of the Law on Public Information Transparency lets the Government act by resolution. It sets the conditions for creating and registering foundational and sector-specific databases. That decides how much data is pulled into the National Data Centre. (4) Article 18.5.9 lets the Government name any further system a 'support system', which then falls under the state infrastructure rules. None of these needs a bill. The privacy law itself has not been changed since it was adopted on 17 December 2021. The Law on Cyber Security was changed on 6 January 2023, to add licensing for audit and risk assessment firms.