MongoliaLaw on Protection of Personal Data, data subject rights
Law on Protection of Personal Data (), Art. 16; Art. 15
In force since .
A data subject rights rule binding public and private bodies.
- Audit expectation
- none
What it requires
- An app must let a Mongolian data subject know whether their data is collected or processed, correct errors, request deletion, obtain and transfer a copy of their own data to a controller of their choosing, and complain about, add information to, or demand reprocessing of a decision that results from processing their data.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Does "хуульд заасны дагуу" ("in accordance with the law") in Article 16.1.6 limit a data subject's request that a controller delete the subject's information to the grounds listed in Article 15.1, or may the subject also ask for deletion on other grounds?
What it makes you log
Logging duty
Article 16 gives the data subject rights to know whether data is collected, processed or used, to know who received it, to correct and delete it, to obtain and move a copy and to complain, and Article 15 lists the grounds on which the controller deletes data. They state rights and deletion grounds and no log, register or record duty. The controller's matching duties sit in Article 18, which this row does not cite; Article 18.2.12 there requires a record of collecting, processing and using data.
- Kind
- None
- As of
What this law does
Article 16 gives a data subject the right to consent to or refuse collection and transfer, know whether their data has been collected or processed, know third-party recipients, correct errors, request deletion, demand enforcement of a legal prohibition on collection, obtain a copy of their own data, transmit that copy to a controller of their own choosing, withdraw from an ongoing processing activity, and complain about, add information to, or demand reprocessing of a decision resulting from data processing.
Art. 16.2 separately gives the subject a right to have unlawful material or moral damage remedied. Art. 15 sets the general deletion grounds: unlawfully collected data, court or treaty-ordered deletion, purpose achieved, or another statutory ground.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .