Processes personal data, in Mongolia

Law of Mongolia on Cyber Security, adopted 17 December 2021, in force 1 May 2022, Art. 17.3 · Read the law's page

• Abide by the Government's common procedure for ensuring, preventing, detecting and countering cyber-attacks once the Government adopts it under Article 7.1.
• On a cyber-attack or violation against your systems, notify the relevant center against cyber-attacks and violations, the Public center for a legal person outside the state information network and outside critical information infrastructure, and obtain assistance where necessary; the text states no numeric clock for this notice.
• Comply with the recommendations and requirements the relevant authorities issue to you in relation to ensuring cyber security.
• This binds every legal person other than one providing information technology processing, storage, distribution, computer-analytics or shared-information-system hosting services under Article 17.1, a narrower duty-bearer this profile records in the jurisdiction summary rather than flags on a declared activity; Article 3.2 extends this duty to a foreign or foreign-invested legal person operating through Mongolia's information systems and networks.

Law on Protection of Personal Data (17 December 2021), Art. 14 · Read the law's page

• An app transferring the personal data of a Mongolian data subject, including a voiceprint or other biometric identifier, to a person, legal entity, or organization in another country must have a statutory basis, an applicable international treaty, or the subject's consent; transfer is prohibited by default otherwise. An app that processes the sensitive, genetic or biometric information of a Mongolian data subject must run it on a server that is located in Mongolian territory and accessible only from Mongolia.

Law on Protection of Personal Data (17 December 2021), Art. 16; Art. 15 · Read the law's page

• An app must let a Mongolian data subject know whether their data is collected or processed, correct errors, request deletion, obtain and transfer a copy of their own data to a controller of their choosing, and complain about, add information to, or demand reprocessing of a decision that results from processing their data.

Law on Protection of Personal Data (17 December 2021), Art. 22; Art. 25.1.3; Art. 10.5 · Read the law's page

• An app that is a controller of Mongolian personal data must notify the data subject immediately when a violation found in collecting or processing the data is likely to harm the data subject's rights and legitimate interests, stating the violation, its likely adverse effects and the measures taken. An app that processes data for a controller must tell the controller as soon as it learns of such a violation. A controller must keep a record of the measures taken against the violation and deliver it to the National Human Rights Commission each January and whenever the Commission requires it. An app that suffers a security breach of, or cyberattack on, an information system used to collect, process or use the data must send a notification to the state digital-development and communications body; the Act sets no numeric deadline for that notification.

Law on Protection of Personal Data (17 December 2021), Art. 4.1.1; Art. 31 · Read the law's page

• An app that captures a fingerprint, iris scan, faceprint, voiceprint, or body-movement identifier from a Mongolian data subject is processing biometric information under the Law's own definition, which explicitly names voice and face. An identifier extracted from a recording via technical means or software falls squarely within this definition. An app or its predecessor that collected fingerprint data before 1 May 2022 must destroy it unless separately authorized by law.

Law on Protection of Personal Data (17 December 2021), Arts. 24-26, 28, 30 · Read the law's page

• An app processing Mongolian personal data may be investigated by a designated National Human Rights Commission member or the state digital-development and communications body, and a person may complain to either, with a further court appeal available. Fines and criminal penalties sit in the separate Law on Violations and Criminal Law, neither of which is confirmed here; a general damages-and-rights-protection remedy exists at Art. 16.2, though it is not framed as a dedicated statutory cause of action.

Law on Protection of Personal Data (17 December 2021), Arts. 4.1.12, 9 · Read the law's page

• An app processing a Mongolian data subject's ethnicity, religion, belief, health, correspondence, genetic or biometric information, criminal-sentence status, sexual orientation, gender identity, or sexual-relations information must satisfy one of the Law's lawful-basis or health or legal-claim grounds before processing; this category expressly includes biometric and genetic information, so an app declaring only a biometric activity is still bound by this instrument, not only by the Law's biometric-data provisions.

Law on Protection of Personal Data (17 December 2021), Arts. 8.9, 18.2.12, 18.2.13, 23.1-23.2 · Read the law's page

• Prove that you hold the data subject's consent when you collect personal data, keep a record of your collecting, processing and use of it, and deliver the Article 23 assessment to the National Human Rights Commission before processing by technology that works without human involvement.

Law on Protection of Personal Data (17 December 2021), in force 1 May 2022, Arts. 1-4 · Read the law's page

• An app that collects, processes, uses, or secures the personal data of individuals in Mongolia, including via a technical device or software, must fall within the Law's scope and its exemptions before relying on any of them. A purely personal or household use, or using one's own biometric information to secure one's own property, is exempt; most commercial or app-based processing is not.