Mongolia

Law on Protection of Personal Information, article 3.1, defines the scope by activity, not by territory or by targeting: it covers relations arising when a person, a legal entity or an organisation without legal personality collects, processes, uses and secures personal data. Article 3.2 extends the same rules to processing carried out with technical means and software. There is no equivalent of the European 'offering goods or services to people in the territory' test and no registration or representative obligation anywhere in the Act. Practical reach comes from three other places: order A/90 of 2023 requires the server that processes sensitive data to be in Mongolia, which is a physical hook; the Law on Public Information Transparency binds anyone carrying out a state function under a law or a contract; and the Law on Telecommunications, article 19-1, brings data storage infrastructure and content delivery networks inside the licensed 'information network' activity, so building a point of presence in Mongolia needs a licence from the Communications Regulatory Commission.

Three layers stack up. (1) National baseline: article 14.1 of the Law on Protection of Personal Information is a prohibition with two exits, a legal or treaty basis, or the data subject's consent. Consent must be written, on paper or electronically, must be verified electronically or against an identity document, and must list every recipient (articles 8.2.6, 8.3, 8.4, 8.11). (2) Data-type wall: Minister of Digital Development and Communications order A/90 of 11 September 2023, clause 3.2, applies to every controller handling sensitive, genetic or biometric data and requires the processing server to be located in Mongolia and accessible only from Mongolia, sited in a purpose-built technical room, able to exchange data through the state 'KHUR' exchange, synchronised to the Communications Regulatory Commission's time server, protected by a certificate and regularly backed up. Because article 4.1.12 of the Act treats correspondence data, meaning letters, parcels, e-mail and anything exchanged over telecommunications and information technology, as sensitive, the reach of A/90 is unusually wide on its face. (3) Public-sector wall: Law on Public Information Transparency articles 18.12 and 27.7 require the core state exchange system and every foundational and sectoral public database to be located in Mongolia, and article 33.2 requires them to be held at the National Data Centre. Foundational databases include the civil registration databases and the geodesy and cartography database (article 27.3). Sectors with no residency rule of their own that we could find: banking and payments, insurance and securities, telecommunications, education and online gaming. For those the national baseline and A/90 still apply.

There is no adequacy list, no standard contractual clauses, no binding corporate rules, no certification route and no case-by-case government authorisation for transfers under the Law on Protection of Personal Information. The only mechanisms are the legal or treaty basis in article 14.1 and consent. Consent must be given in writing on paper or electronically (article 8.3); an electronic consent is valid only if the person was identified and authenticated by a means set by law or accepted by them (article 8.4); silence or a lapse of time is expressly not consent (article 8.6); the controller must be able to prove consent (article 8.9); consent is needed again for any new purpose (article 8.10); and separate consent is needed to pass data on unless the original notice already listed the recipients (articles 8.2.6 and 8.11). Consent can be withdrawn at any time and the controller must make withdrawal easy (articles 8.7 and 18.4). Note the mismatch: for sensitive data, consent gets you past article 14 but not past order A/90, which fixes where the server may sit regardless of what anyone agreed.

Law on Protection of Personal Information, article 24, gives the National Human Rights Commission the supervisory role: monitoring compliance, receiving and investigating complaints or acting on its own initiative, issuing demands and recommendations, receiving controllers' annual incident registers every January, reviewing impact assessments, and reporting on data protection in its annual report on the state of human rights. Article 24.2 requires one named Commission member to carry this portfolio. Article 25 gives the Ministry of Digital Development, Innovation and Communications the rule-making role in the digital environment: approving technology security requirements for sensitive, genetic and biometric data, and receiving and registering notifications of security failures and cyber attacks. Article 26 leaves every other state body to supervise within its own statutory remit. Fines are not in the privacy law at all; they sit in the Law on Infringements, article 6.27, and are applied by inspectors, the police and the courts. Observable evidence of activity is on the ministry side: order A/90 in 2023, the joint risk assessment methodology A/30 and A/148 in 2024, and a register of 49 legal entities permitted to carry out information security audits with permissions running from 2026 to 2029. The National Human Rights Commission is a long-standing, staffed national human rights institution, but its website is a JavaScript application whose content we could not retrieve, and we found no published data protection decision.

The ceiling side is article 15 of the Law on Protection of Personal Information: you delete on the data subject's request where collection or use was unlawful, where a law, treaty or final court judgment orders it, or where the original purpose has been achieved or the contract or agreement says so. Article 15.2 then forbids deletion on any other ground unless another law provides for it, which turns the usual 'delete when you no longer need it' instinct on its head and makes routine data-minimisation purges legally risky without a documented ground. The floor side is scattered: Law on the National Payment System, article 30.1, requires operators, participants and payment service providers to keep documents arising from payment system activity for at least 15 years from receipt or creation; order A/90 clause 3.1.6 requires a historical register of every change, deletion and restoration of sensitive data; Law on Cyber Security articles 17.1.3 and 19.2.9 require information system activity logs to be kept for the period set in the general cyber security procedure approved by the Government, a period we could not verify. One oddity worth knowing: article 13.2 of the privacy law allows sensitive data of a dead person to be processed without consent once 70 years have passed since death.

Clock one, to the individual: article 22.2 of the Law on Protection of Personal Information requires the controller to notify the data subject immediately where a breach may harm their rights or lawful interests, and article 22.3 sets the contents, namely who and what was affected, the controller's name and contact details, the possible consequences and the remedial steps taken. A supplier who spots the breach must tell the controller immediately (article 22.1). Clock two, to the ministry: article 25.1.3 requires the ministry to receive and register notifications from controllers that an information system used for personal data has suffered a security failure or a cyber attack, and to act immediately. Clock three, to the cyber response centres: Law on Cyber Security article 17.1.2 requires information technology service providers to notify the relevant response centre of a cyber attack immediately and to seek help if they cannot stop it, article 17.1.9 requires them to notify affected users immediately, and article 19.2.14 requires critical information infrastructure organisations to notify immediately once normal operation is lost. Article 4.1.3 of the privacy law defines 'immediately' as the shortest possible period, so there is no safe-harbour number of hours to plan against. The annual filing is article 22.6: the register of breaches and responses goes to the National Human Rights Commission every January, and on demand at any time. There are two centres to choose between: the National Centre sits inside the intelligence agency and covers state-owned critical infrastructure and bodies on the unified state network; the Public Centre sits under the ministry and covers everyone else.

(1) Article 10.1 of the Law on Protection of Personal Information reserves the collection of fingerprints and genetic data to five named state bodies for five named purposes. Article 10.2 lets an employer use biometric data other than fingerprints, with the employee's consent, to make identity checks easier under its internal labour rules. Article 10.3 then forbids the employer from altering that data or passing it to anyone else, which rules out an offshore biometric access control vendor. Article 31.1 required fingerprints collected before the law started to be destroyed. (2) Article 4.1.12 lists correspondence among sensitive data, and article 4.1.4 defines correspondence data as letters, parcels, e-mail and anything exchanged using telecommunications or information technology. Read literally with clause 3.2 of order A/90 that puts an ordinary hosted mailbox inside a server-in-Mongolia obligation. We have found no guidance narrowing this and no enforcement testing it. (3) Property, education, membership and digital identifiers are ordinary personal data under article 4.1.11; health, correspondence, genetic and biometric data, digital signature private keys, criminal record, sexual orientation, gender identity and sexual life are sensitive under article 4.1.12. Money is not on the sensitive list. Biometric authentication is. (4) Article 30.2 says individuals and legal entities that breach the law bear liability under the Criminal Code or the Law on Infringements. Under the Law on Infringements article 6.27, unlawfully obtaining, processing, transferring or disclosing sensitive data costs an individual 2 million tugrik (about $600) and a company 20 million tugrik (about $5,700), and using data outside the original purpose costs an individual 500,000 tugrik (about $140) and a company 5 million tugrik (about $1,400). (5) Article 19-1 of the Law on Telecommunications puts internet protocol interconnection, data storage infrastructure, content delivery networks and virtual networks between demarcation points inside the licensed information network activity, so a local point of presence needs a licence from the Communications Regulatory Commission. A sixth, for critical infrastructure: if a foreign national or foreign company performs your cyber risk assessment you must first obtain the opinion of the intelligence agency.

Featured on the ministry's own home page on 18 August 2026: 'Give your feedback on the draft primary Data Law', recording that by minute 18 of the Government meeting of 13 May 2026 the Government directed measures to create the legal environment for putting data into economic circulation and reuse and to prepare for establishing an energy-efficient green data centre in Mongolia. No text, no bill number and no consultation deadline were published on the page we retrieved, and the linked detail page returned an error. Dormant switches to watch, in order of how fast they could move: (1) article 20.2 of the Law on Protection of Personal Information lets the ministry set, by order alone, the security requirements, the assessment methodology and the requirements for storage technology, which is exactly the power used to create the server-in-Mongolia rule in 2023 and can be widened the same way; (2) article 25.1.2 lets the ministry approve technology security requirements for sensitive, genetic and biometric data; (3) article 27.9 of the Law on Public Information Transparency lets the Government set by resolution the conditions for creating and registering foundational and sectoral databases, which determines how much data is pulled into the National Data Centre; (4) article 18.5.9 lets the Government designate any further system as a 'support system', which then falls inside the state infrastructure regime. None of these needs a bill. The privacy law itself has not been amended since it was adopted on 17 December 2021; the Law on Cyber Security was amended on 6 January 2023 to add the licensing of audit and risk assessment firms.