Duty LXD-1358
Processes biometric data, in Mongolia
Law on Cyber Security, Cyber-Attack Notification Duty for Other Legal Personssince 3 lines
Law of Mongolia on Cyber Security, adopted , in force , Art. 17.3 · Read the law's page
- Abide by the Government's common procedure for ensuring, preventing, detecting and countering cyber-attacks once the Government adopts it under Article 7.1.
- On a cyber-attack or violation against your systems, notify the relevant center against cyber-attacks and violations, the Public center for a legal person outside the state information network and outside critical information infrastructure, and obtain assistance where necessary; the text states no numeric clock for this notice.
- Comply with the recommendations and requirements the relevant authorities issue to you in relation to ensuring cyber security.
- This binds every legal person other than one providing information technology processing, storage, distribution, computer-analytics or shared-information-system hosting services under Article 17.1, a narrower duty-bearer this profile records in the jurisdiction summary rather than flags on a declared activity; Article 3.2 extends this duty to a foreign or foreign-invested legal person operating through Mongolia's information systems and networks.
Law on Protection of Personal Data, cross-border transfersince 1 line
Law on Protection of Personal Data (), Art. 14 · Read the law's page
- An app transferring the personal data of a Mongolian data subject, including a voiceprint or other biometric identifier, to a person, legal entity, or organization in another country must have a statutory basis, an applicable international treaty, or the subject's consent; transfer is prohibited by default otherwise. An app that processes the sensitive, genetic or biometric information of a Mongolian data subject must run it on a server that is located in Mongolian territory and accessible only from Mongolia.
Law on Protection of Personal Data, biometric information definition and legacy fingerprint destructionsince 1 line
Law on Protection of Personal Data (), Art. 4.1.1; Art. 31 · Read the law's page
- An app that captures a fingerprint, iris scan, faceprint, voiceprint, or body-movement identifier from a Mongolian data subject is processing biometric information under the Law's own definition, which explicitly names voice and face. An identifier extracted from a recording via technical means or software falls squarely within this definition. An app or its predecessor that collected fingerprint data before must destroy it unless separately authorized by law.
Law on Protection of Personal Data, sensitive personal informationsince 1 line
Law on Protection of Personal Data (), Arts. 4.1.12, 9 · Read the law's page
- An app processing a Mongolian data subject's ethnicity, religion, belief, health, correspondence, genetic or biometric information, criminal-sentence status, sexual orientation, gender identity, or sexual-relations information must satisfy one of the Law's lawful-basis or health or legal-claim grounds before processing; this category expressly includes biometric and genetic information, so an app declaring only a biometric activity is still bound by this instrument, not only by the Law's biometric-data provisions.