MongoliaLaw on Protection of Personal Data, cross-border transfer
Law on Protection of Personal Data (), Art. 14
In force since .
A cross border transfer rule binding public and private bodies.
- Audit expectation
- none
What it requires
- An app transferring the personal data of a Mongolian data subject, including a voiceprint or other biometric identifier, to a person, legal entity, or organization in another country must have a statutory basis, an applicable international treaty, or the subject's consent; transfer is prohibited by default otherwise. An app that processes the sensitive, genetic or biometric information of a Mongolian data subject must run it on a server that is located in Mongolian territory and accessible only from Mongolia.
These lines are LexLint's reading of the law's text.
Who enforces it
Settledness
A Minister's order of on processing sensitive, genetic and biometric information requires the server that processes that information to be located in Mongolia and reachable only from Mongolia.
- As of
- Open questions
- Does the prohibition in Article 14.1 on "дамжуулан өгөхийг хориглоно" ("transferring is prohibited") information to "гадаад улс дахь хүн, хуулийн этгээд болон олон улсын байгууллагад" ("a person, legal entity or international organization in a foreign country") cover a Mongolian controller's use of a processor abroad, or only a hand-over to a foreign recipient that holds the information for its own purposes?
What it makes you log
Logging duty
Article 14.1 prohibits passing data to a person, legal entity or international organization abroad unless a law or an international treaty of Mongolia allows it or the data subject consents. It requires no log, register or record of transfers. The requirement that sensitive, genetic and biometric data be processed on a server located in Mongolia comes from the Minister's order, not from Article 14.
- Kind
- None
- As of
What this law does
Art. 14 is a one-paragraph default prohibition: transferring information to a person, legal entity, or international organization in a foreign country is prohibited except as provided by law or an international treaty of Mongolia, or with the information owner's consent. The Act has no adequacy-assessment mechanism, and its own text sets no requirement to store data in Mongolia.
Under Article 25.1.2 the state digital-development and communications body approves the technology security requirements and rules for processing sensitive, genetic and biometric information. Minister's Order A/90 of sets those technology security requirements, including that the server which processes that information must be located in Mongolian territory and accessible only from Mongolia (items 3.2.1 and 3.2.2). The cross-border restriction here is therefore strict rather than moderate.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .